cf71da7cff582efc534f3bb50af259bb8d84c9475977cb821419853cfb7f8a97

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6589ba51eba11dc292584ca6ab85bfa0N.exe
Size

71KB
MD5

6589ba51eba11dc292584ca6ab85bfa0
SHA1

c95dfe77b73bff6424c3453c8b608f18df5a0297
SHA256

cf71da7cff582efc534f3bb50af259bb8d84c9475977cb821419853cfb7f8a97
SHA512

17658583265f6b68ed0f004adac2968c05bf186c423512ab2979edb1417fe1ae63c1559dd0b5cc419b50e2c9d8aaef667dea603c163f7fa05be720f1b790582a
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8wY0kvRkvk:fnyiQSodY0kvRkvk

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4620-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000234a2-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/4620-1868-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoBeta.png.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\ConvertSave.pptx.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	6589ba51eba11dc292584ca6ab85bfa0N.exe

C:\Users\Admin\AppData\Local\Temp\6589ba51eba11dc292584ca6ab85bfa0N.exe
"C:\Users\Admin\AppData\Local\Temp\6589ba51eba11dc292584ca6ab85bfa0N.exe"
1⤵
- Drops file in Program Files directory
PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
71KB

MD5
a1ad601ccd9e47b60c9b8254f1dea00b

SHA1
5d168353cc5ef6b1ae9ed55ccdfa492ce7e988eb

SHA256
33b2642ab3bd1e575ae0261b9e9fd0609367f11cd49c31f62c1e5bba33d2c9e6

SHA512
927a61a19dd1c84d3170ef823910c341638cdc7a932a2dd47bf2b9c7a8aa3ff06dab80dbba64c28975afc46654a096cfb5f9b6e800051d2a828361246c4e3ef1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
4fa9f6374321f2c9898ec4d7e31227e9

SHA1
0b6fb813aa627a115dfd2117f281ee269de1015f

SHA256
0066e24afa923a585c49c86dc26eb8cfbdd5c2ea6502438fa378d9d6270fd1f9

SHA512
5f068742f0f3f57cd5f69f1eaf947507ee19234aad55927e0eaf2d639eec2fb4783408e4772ca6c15fa10ff428b0b2522f2f034b98dcd308160096cb11f154c9

Download Submit
memory/4620-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4620-1868-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads