29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
Size

103KB
MD5

041b6a5f58f4216aa702da36f1bb18ba
SHA1

44d1738ea2aaa8aaf0aa8125feea0e3238d303a2
SHA256

29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d
SHA512

45f26f15e11da9979df82fb0ccb5724289d95cd77cc6f1487e1457062f68aac64f917c556f3eb2e264c2fe21a9aea86d9668a03abe7c4816c98acae1cedb4c84
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0xz:hfAIuZAIuYSMjoqtMHfhfW

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (986) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1348-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0008000000023286-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/1348-298-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1348-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023286-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1348-298-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.Lightweight.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\CompleteDebug.mpa.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Primitives.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationUI.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Controls.Ribbon.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Primitives.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Pkcs.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClientSideProviders.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.PerformanceCounter.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Input.Manipulations.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClientSideProviders.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Xml.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClient.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-memory-l1-1-0.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebProxy.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationFramework.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Console.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe

C:\Users\Admin\AppData\Local\Temp\29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe
"C:\Users\Admin\AppData\Local\Temp\29dee12c4642eb67aae8ec42d97dcbdf873803136f85d4474ae60213f3c94f3d.exe"
1⤵
- Drops file in Program Files directory
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
104KB

MD5
7eea82d2f435e5b24bfa9a9e2f2987eb

SHA1
9446c4732ee612fe3726017f3c073f72f422039e

SHA256
e1d1668ddb6bb3d744693b29d759152265eba5ba8901345d95e76ca6db98c9c2

SHA512
2f092bf4588cfa9f7f1fa9dde25542b0cb695c1c04c922714f90772a8d9a26d49a12f25a339e8eec0b4357f870593e901e1affce6c1326939d3f10f94c8fd106

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
104KB

MD5
812c744f9d3bff5624d6df29b4b0a5e9

SHA1
0a3d4797ba4caeddb5db5eb97063d8f6dee312ea

SHA256
38cd5b3cf02861029a0e85107f7ce6dc11d19c92bb0e0435a4da0e679aa22108

SHA512
e82e921f60c366dd0053dd415e4565f81dd331757f84700306e0169cddb8854b1f426c35ac91c38872c967d2e2120e25d621416336e27af7b29af40d7808a47e

Download Submit
memory/1348-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1348-298-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download