c13f794fd51f816b877972a5a291ac0c76c03063955c1c88195bcaf1a198eee7

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ebd7261de17a16db62edecde1295fe0N.exe
Size

90KB
MD5

3ebd7261de17a16db62edecde1295fe0
SHA1

d45a1d1dbd44bddaa05d419d679cd6e01e15afa5
SHA256

c13f794fd51f816b877972a5a291ac0c76c03063955c1c88195bcaf1a198eee7
SHA512

f62a7d1323438fb6315635384a5b2d5a06c4680630e5daab78ed8ab7487b256655d2ef7b067c41a5ebcffc42fe252ec0ae38cdd29a681615dbc464e154cbda55
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxviYiaEH:fnyiQSo4iYi9

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/396-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347a-2.dat	upx
behavioral2/files/0x0014000000022909-7.dat	upx
behavioral2/memory/396-1756-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	3ebd7261de17a16db62edecde1295fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	3ebd7261de17a16db62edecde1295fe0N.exe

C:\Users\Admin\AppData\Local\Temp\3ebd7261de17a16db62edecde1295fe0N.exe
"C:\Users\Admin\AppData\Local\Temp\3ebd7261de17a16db62edecde1295fe0N.exe"
1⤵
- Drops file in Program Files directory
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
90KB

MD5
673626b8db0886fd90cb9c71d886314e

SHA1
d57a6b87eb540be546f34abf95acd2d73548bce6

SHA256
569b0cf36e95844c512e9737f8c1260f6341a3730b8bbf1cd795cbec6ad5b719

SHA512
7e9ac63add3272c4c36de220459aa66650d6eb19d5304bfdf5b8c4d9a6197d52ad11f88e225fba8a3ea11f12b13dfc60196179050601b88c88e23e7719af294d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
189KB

MD5
46ee66a3ba6d3eb6a913a9426c9904d3

SHA1
638e8e2a1b8884cbdcf1cd6d6cda1cb1bfc94c5d

SHA256
90157ac257e2703ba1e6b00398218d82ebce7bc5da6a1f688bc78cac8abc830e

SHA512
5f14b0d51a978217d63f8c5c15911e24c185f18e71603f19cd4b6242dc1daf9e59a91deec8d65bd479c187c9b3f712bac94de3e62ddf09dd2e95f34ce10036b4

Download Submit
memory/396-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/396-1756-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads