d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
Size

58KB
MD5

8e8a20b51932c5ee2815e84a5187d57b
SHA1

04b56045c184e0976710fe76fa35dcc9363c1c8a
SHA256

d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17
SHA512

0e2bd3c400cf03d7a263e11641f2e7832dab73124244c389b20e60f5bb8207e55e939ccce4f56a1e4d5539961eaf63c1178c71c327dc2ed19c2431049f147d08
SSDEEP

1536:V7Zf/FAxTWoJJ7TTKP2awclvmxaKP2awclvmxi:fny1aP2awclvmxrP2awclvmxi

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5007) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2560-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023459-2.dat	upx
behavioral2/files/0x001400000002291a-6.dat	upx
behavioral2/memory/2560-1930-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\v8_context_snapshot.bin.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\es.pak.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe

C:\Users\Admin\AppData\Local\Temp\d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe
"C:\Users\Admin\AppData\Local\Temp\d6c1996da395665015fc340da1997598495fa28e273285a37a745b53f5dbcf17.exe"
1⤵
- Drops file in Program Files directory
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
59KB

MD5
b287427478a834d62d7a9613ad04a659

SHA1
0d2deb0122b62c1e2bfcd62ae90ebd316e762cd7

SHA256
37bf99e3f354318df9191ee7db0d1868973c560fa79dc09861694f136e8247c6

SHA512
66d17bede8921fabdd7342bc9668477e0083e6355693a1ba51bcca60f109375e0e433742228144fde84dc9e896c43fd73f6ae9f7d70f82e7eeaf24c47225acd9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
008af89b33da7387f7c0cd6d8cd64769

SHA1
dd56c43909404a54af3d3394031f216af93bbab9

SHA256
daf31fcb9682eafef8e4d53de72b74b65895ffb1c103651a26548677ded42317

SHA512
75015a70bd91d456deca551a9198d449591d94919bfbc1f24e5a0cb4ebe4fb88e1058d1a4d97522cc6204b898337668946b426d6d4a2d525ba0c280920a29b72

Download Submit
memory/2560-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2560-1930-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads