522be1690277a9305f2817f75bd3ff78139d928160ddc74e950f38d2a5964ba8

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c324f1b804a061897959ddecac28190N.exe
Size

68KB
MD5

0c324f1b804a061897959ddecac28190
SHA1

97902fcf1a4e01f5fb045442b61906a9ca2de634
SHA256

522be1690277a9305f2817f75bd3ff78139d928160ddc74e950f38d2a5964ba8
SHA512

c8755286eceb678c11cdcc5561d12e7597a0cae77ea72b6658317ee684daaea1fa309de5d99b8dbc35a3a252c2319b9718d97a28eecc810c021bddd0c3c53295
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxviYiaEF:KQSo4iYiX

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1036-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00080000000234e8-2.dat	upx
behavioral2/files/0x001400000002291a-6.dat	upx
behavioral2/memory/1036-1032-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\it.pak.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	0c324f1b804a061897959ddecac28190N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	0c324f1b804a061897959ddecac28190N.exe

C:\Users\Admin\AppData\Local\Temp\0c324f1b804a061897959ddecac28190N.exe
"C:\Users\Admin\AppData\Local\Temp\0c324f1b804a061897959ddecac28190N.exe"
1⤵
- Drops file in Program Files directory
PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
68KB

MD5
ab68070019a1130d74abdadbac983546

SHA1
03df66e91edc7185d89885f44ced7a2327b25276

SHA256
0d1e00635c60a8305c9be9f27446195b09535d68072c22b3509398ce2cf13337

SHA512
5969883d4ca0d45ac569d139aed7c91b650f73c682a24064a706fe2a9168a8773a9c8b0f5c1ad7e8d7ca2d6e351082f9c038ec97917a6d88169226fa97881e27

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
01abb22fe23b35928fdb73f2c7ca0fd0

SHA1
a98b240660e8b579ad8f355712db9b994cb9a136

SHA256
ea07a482affd43cc0114742cf2e838915a5cef7bffab9646409579cb8057d04e

SHA512
baa81a09852dbc2428921f926855c39d726f1a0ab0443516430553c9ae853bdcc00ffe44e621d7cbdb59a4e88c7257e0f24cd20e33cadcf53074ac4fef526800

Download Submit
memory/1036-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1036-1032-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads