0d7ce5a06e274412265344d46075952164128f1e842c976ea9437ebe86075b8e

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a802c55aeac0e0480327bce6d1427740N.exe
Size

19KB
MD5

a802c55aeac0e0480327bce6d1427740
SHA1

5d75c8095fd15a18902d34035b07de5a8fcda368
SHA256

0d7ce5a06e274412265344d46075952164128f1e842c976ea9437ebe86075b8e
SHA512

d138a72f050776f153490275197c231868b29070eee0592400975c069404f8d3130ed9372ef63b3451f1b14264477d09849b17072913f3874ffa40ae91c9f013
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJcbQbf1Oti1JGBQOOiQJhAT17ToR+Oi6J+foR+Oi6J+x:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJ2

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4374) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2264-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002351f-2.dat	upx
behavioral2/files/0x001400000002292d-6.dat	upx
behavioral2/memory/2264-1100-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ru.pak.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\d3dcompiler_47.dll.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sw.pak.tmp	a802c55aeac0e0480327bce6d1427740N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	a802c55aeac0e0480327bce6d1427740N.exe

C:\Users\Admin\AppData\Local\Temp\a802c55aeac0e0480327bce6d1427740N.exe
"C:\Users\Admin\AppData\Local\Temp\a802c55aeac0e0480327bce6d1427740N.exe"
1⤵
- Drops file in Program Files directory
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
20KB

MD5
1d947cfb8c402d94bba22f086d7f4c96

SHA1
40838dbf2190d57506a1ec5065cc384476b9dcaa

SHA256
0a0717ff95db4c3a3cbabef3d371a4c574738116d050849094777d2fa4227e67

SHA512
7d0663387d8361988d4c90355b4324ea40be55aa12faa7f1b25d655003f70c9e14150b8890f1b3e88b997bf3b8b7580e2d7150d1acfcbe2882e3aba7d592bf5a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
119KB

MD5
a225d2415bea244aa738c50fe5fdd437

SHA1
d0a00776a741776d04c097c6841f5b9bf548c5a1

SHA256
091d1586cc9f995b2c65f65ee78785f977423a3d4f8e24401b6e777677d44e2b

SHA512
3a746a5eea2154738d51f29e25da50b4454db3a24d5993bea5de3e29e56304f22cb13639605ae2acc4242dba72c1fb7bfc2bbe09abcc3c67e0e1dda0395b5953

Download Submit
memory/2264-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2264-1100-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads