ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73

Analysis

max time kernel
149s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
Size

69KB
MD5

fa7f0b0d9a3ecdfc7f7f998dc2b73fe9
SHA1

31c18d471ec139582514e75f9ed805ebbdfb9e76
SHA256

ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73
SHA512

2048c1d1eeefa25f337fd3ab57477337130ee0e823a21897f8f32c08cb163715edaf646f6b859e4c3b411e52d1823d4a6487f3d9d13af56f5b3aad5c12c9ace3
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwABT37CPKKdJJxdPO9Ot6K/K2Z2:V7Zf/FAxTWoJJ0TW7JJQOEK/K3

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5036) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1980-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1980-1838-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1980-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1980-1838-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_wer.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe

C:\Users\Admin\AppData\Local\Temp\ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe
"C:\Users\Admin\AppData\Local\Temp\ed4cb53672d795e902de707430430f4ee4cc602e75631bb63490b35c9a061b73.exe"
1⤵
- Drops file in Program Files directory
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
Filesize
69KB

MD5
e4886f9a54e790d088d75d46e6f80dc0

SHA1
3a96fafc50115b1da45c87909f1fc94302e81de8

SHA256
e0b6bda5f29b6875ca800e086eef78954d64b839f5239e564558f8b4dd46d6eb

SHA512
88b8057f33cc8622aaa31ab2eaf4e3a7a1fc4ae5fa67fa01ade7038766b8267ee95eb1994b5a4fecc62b843ac3f830b66ed322c0d69600a95b5f94ddac47fa50

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
168KB

MD5
6c5178b520644c92adab4ed11af9473d

SHA1
48fd4ee5d36f99cfe33e15f1e67a45fae6732c42

SHA256
36a98f8d52cea100e7f437572f1003f081800f76e26b6f46e2617855580599a8

SHA512
008df665316a97963fb919cc4817dcfa525d898717f66d03e89dd1e3d3e7f25997ef8341408ee00596556574f0f632aaf556ff3ef250346dd04be15ddeabf94f

Download Submit
memory/1980-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1980-1838-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download