af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31

Analysis

max time kernel
127s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
Size

145KB
MD5

8d3fd510ecfb8a4fe1266fa96b935ca9
SHA1

c84f8f5a8045d4bdab49546f066a9f6bbbbb07b2
SHA256

af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31
SHA512

fd5198ff3f661b08974cfabe02f32377c1bd20098a16ad8bc7ab526779c450eff2b2fa3d0e8fca48ecbaac761a2e023b7febb783df8a4da91ed020b8eadc5774
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJz:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuR

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (594) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2964-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000800000002323e-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/2964-216-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2964-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002323e-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/2964-216-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\hostfxr.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Annotations.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Registry.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-1-0.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Extensions.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Primitives.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.FileSystem.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Specialized.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe

C:\Users\Admin\AppData\Local\Temp\af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe
"C:\Users\Admin\AppData\Local\Temp\af7eec6d320279b921e6ddd499055d2418352c0a41367bca037c32dac81a3a31.exe"
1⤵
- Drops file in Program Files directory
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
145KB

MD5
a1a837709e3dc21776a5b09cac0ec538

SHA1
8a50e6f4b3b68a8279ae7552c084679e89041f01

SHA256
74a798ac7e101d1efdee8449353d59329103032548fe6292dcdc2dc6f609fe4a

SHA512
221bc4ee92749339d840042adb5c4cd5db13a54896b17349ecea76b67dd510e69d7e5322caf379049fa5cc7bb85e1345600f05c12b8c7be4ebf05592d3e7ea7c

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
145KB

MD5
512a06384a583b68eab9a5cc4bd5defd

SHA1
b06ef33154a459d5196bab2703c0de63b419caca

SHA256
4a39e9ebb62871bd59e42693ea26b4116bb8f75eae3257382686ec643ac8b146

SHA512
3cc86c678a360fa67f66d4c3ae1ad3984879c649fff237874be33e2224c007d2af67eeaf56ebb8053939366c2028012720aa8bd8bf8516a49351f06f6b1db8df

Download Submit
memory/2964-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2964-216-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download