0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0

General

Target

0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
Size

68KB
MD5

0ea51e3789191515aa2401571376bd5c
SHA1

df1db6ed47a49f7d59f59a5296003dc9399373ba
SHA256

0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0
SHA512

bdd1370dddfdf27374c8f9cabe756d51a7d2bb7fdd8554a1e257a42055d72a71bf72a61be746527d21539880798991d667c6918bb3b59f3059c28ad09d0aba27
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8p:fnyiQSoC

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1388) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4832-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	UPX
C:\libsmartscreen.dll.tmp	UPX
behavioral2/memory/4832-286-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4832-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/4832-286-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsFormsIntegration.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Threading.AccessControl.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Quic.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlDocument.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XDocument.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Primitives.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClient.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\UIAutomationTypes.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.DataSetExtensions.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Permissions.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\WindowsBase.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationTypes.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ValueTuple.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsFormsIntegration.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.MemoryMappedFiles.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-private-l1-1-0.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsFormsIntegration.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Channels.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationTypes.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsFormsIntegration.resources.dll.tmp	0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe

C:\Users\Admin\AppData\Local\Temp\0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe
"C:\Users\Admin\AppData\Local\Temp\0e7a3459bc7961a220ccac686d74c5e88eaad8b096ff5a37bd875a605fa9f8f0.exe"
1⤵
- Drops file in Program Files directory
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
68KB

MD5
8a0c1f8a207a5f04567b67070c8c7c72

SHA1
549afe778283f48ed71cb10770ab684f70cdb0f9

SHA256
c0a205eda4cd6fe9a71d31d9c89337270927742ed6b2286073abf42fac87f8c4

SHA512
268c9ac5885d22b0b0ae56bfcbe61f0bcfc05f99dc1fb3eb137d0283401516bbcc03a59388a94c6b071d5d085b5d406296c574df6e65ef1f1052a1e4d527ad0e

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
68KB

MD5
1e033d558eb09a9769fd1485ea3b6a2a

SHA1
41f0cb5cc4219765e982d4252a6e17194353cd30

SHA256
019111c5db4e4f73f9dd9784b30b0f84cb8a970c5e02bbe55bef17634b7c0e1d

SHA512
19c8a0cc8557273fe3f23d3fea230e08cbe4979a2b29f37cd2b3f55eefe2af0d80befb022b36444e827f7220227334fd41aa3f6d968cf7ebe665ea5fca22467a

Download Submit
memory/4832-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4832-286-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads