ec6d0662e4962794f9604078869c19bc5a4f5081a6e2613421f58f11aa3f68e6

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b2d756f9c1d6c09386e864995ee6f60N.exe
Size

48KB
MD5

3b2d756f9c1d6c09386e864995ee6f60
SHA1

42f10e26dc537fe3512a943449d0e75500c74de9
SHA256

ec6d0662e4962794f9604078869c19bc5a4f5081a6e2613421f58f11aa3f68e6
SHA512

3f0d99b6621e9942050d4530d906e2328b39fa73fd5e72aa6c87250fbe8fb2b34b62c5c900fa72c4c7a9ac22428893364aed13c7a35f4ea4f7bb696421751de5
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzP:CTWn1++PJHJXA/OsIZfzc3/Q8zx2u9

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4124-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000a0000000234d6-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/4124-1218-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lt.pak.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxil.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	3b2d756f9c1d6c09386e864995ee6f60N.exe

C:\Users\Admin\AppData\Local\Temp\3b2d756f9c1d6c09386e864995ee6f60N.exe
"C:\Users\Admin\AppData\Local\Temp\3b2d756f9c1d6c09386e864995ee6f60N.exe"
1⤵
- Drops file in Program Files directory
PID:4124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
48KB

MD5
3463ea84cfe57bc58c278667e9b3c751

SHA1
2e91302b789d469513180c360354bdf90abe2294

SHA256
fc5c5f93824132f772755ba6917e34bbaa7de179733b38e5e8fa67dbb9cdff87

SHA512
c176d5623a460cbb031d4294a926801ce176c05440902a1d9b0fff4b87e9a6350e109563c2011502d7230bcdd621f0b467a814673b5df0ac9df3249e050f3aa1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
b83ccde2d71dab3b41f50b1006bf82f9

SHA1
72bd83761c996856dabc26017516c2a5be735ea3

SHA256
dc628aa028f70eee9032bb8d953eb771432830be8154ea6d13d80fba90ee0ab1

SHA512
98260b5b050a104b2f7f93e8bd3e1a0a105feb86de569cbc4d2ccc722b5a6d37deabda514d03d9bda457b8cf0b74555655e43649ecad99bf01ff6e2026043f7a

Download Submit
memory/4124-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4124-1218-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads