af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31

Analysis

max time kernel
127s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
Size 145KB
Sample240509-c9b92aec9w
SHA256 af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31
MD5 8d3fd510ecfb8a4fe1266fa96b935ca9
SHA1 c84f8f5a8045d4bdab49546f066a9f6bbbbb07b2
SHA512 fd5198ff3f661b08974cfabe02f32377c1bd20098a16ad8bc7ab526779c450eff2b2fa3d0e8fca48ecbaac761a2e023b7febb783df8a4da91ed020b8eadc5774
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJz:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuR
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (594) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2964-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000800000002323e-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/2964-216-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2964-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002323e-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/2964-216-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\hostfxr.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Annotations.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Registry.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-1-0.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Extensions.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Primitives.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.FileSystem.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Specialized.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe

C:\Users\Admin\AppData\Local\Temp\af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
"C:\Users\Admin\AppData\Local\Temp\af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe"
1⤵
- Drops file in Program Files directory
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 145KB
SHA256 74a798ac7e101d1efdee8449353d59329103032548fe6292dcdc2dc6f609fe4a
MD5 a1a837709e3dc21776a5b09cac0ec538
SHA1 8a50e6f4b3b68a8279ae7552c084679e89041f01
SHA512 221bc4ee92749339d840042adb5c4cd5db13a54896b17349ecea76b67dd510e69d7e5322caf379049fa5cc7bb85e1345600f05c12b8c7be4ebf05592d3e7ea7c
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJ3:KQSo1EZGtKgZGtK/PgtU1wAIuZAIut
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 145KB
SHA256 4a39e9ebb62871bd59e42693ea26b4116bb8f75eae3257382686ec643ac8b146
MD5 512a06384a583b68eab9a5cc4bd5defd
SHA1 b06ef33154a459d5196bab2703c0de63b419caca
SHA512 3cc86c678a360fa67f66d4c3ae1ad3984879c649fff237874be33e2224c007d2af67eeaf56ebb8053939366c2028012720aa8bd8bf8516a49351f06f6b1db8df
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJF:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuP
MD5 SHA1 SHA512 SSDEEP