b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
Size

112KB
MD5

cc28f7fa75a1a6583b8512e358ac987c
SHA1

634a692346c8bb80ca1829afbd97e435a5c83a2e
SHA256

b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1
SHA512

e8c5bba242a44d3a82db964d2d2085b8f4f12ecda852ed21dd30de75e6d0e2b2c1978a191b7d19c395fe807df52f0798a1ba00da85171074474ca768c0f6de52
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf5Sb:hfAIuZAIuYSMjoqtMHfhf5Sskf

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3844-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0008000000023244-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/3844-22-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3844-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023244-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/3844-22-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Primitives.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.AccessControl.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.AccessControl.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Numerics.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationTypes.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemCore.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Controls.Ribbon.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClient.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-2-0.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlSerializer.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\ReachFramework.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Registry.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Luna.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Presentation.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Xaml.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationTypes.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Writer.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Mail.dll.tmp	b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe

C:\Users\Admin\AppData\Local\Temp\b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe
"C:\Users\Admin\AppData\Local\Temp\b9098a9f2987bf183d2c6ff2b0b77c658e8a4433973a3a78a0e89ebb9ddf7fc1.exe"
1⤵
- Drops file in Program Files directory
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
112KB

MD5
5cd276d3699057ea16f0527aff27fe12

SHA1
b05e7f1192ca2b34c3cee71986d59b6138d1f84c

SHA256
3a33241b1784c05ecfb2fe02b90c53bf4884b6f22c48e02c59239759cc5d6db7

SHA512
b858ee5f647b318d1bef1a34aa6ac909563bbb088d2913e7921ba5dd73b4647dcbc6c399617556fd4c2492c77739eb05b8b36488241da8f54856611308ec170c

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
112KB

MD5
c46fa99c64f29af3a2f94ec6c3f6d067

SHA1
9b55e520046f280dfc02c0061c9bb5dca3e5e374

SHA256
f60df6e3d6b8b9f3405eddb381deddd105998ad425a3d2ff9c4a74512e731d36

SHA512
2f23ea27d476b34b25a6c81cbac9f6862615870075a04881a5d0d61abdc5b782e6a78a6476eb672bb151b2703545e4e64f8b30530292e428534467ed9d01edc2

Download Submit
memory/3844-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3844-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download