6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452

General

Target

6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
Size

47KB
MD5

42f23960db54bd87dbc8c6c0f0f0b9ea
SHA1

cec752f1ac3371f5e8a3b9608f0e22a766131efa
SHA256

6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452
SHA512

cdc1ecce363c6bd0224e7a0fd7c1bc36c8080c5097f66e73c7a5b6f023677285603994396c02607f3b01d4fc1b793099b72cbce08dab3e172e7b4408342fc72d
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzV:CTWn1++PJHJXA/OsIZfzc3/Q8zxD

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1952) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	UPX
C:\libsmartscreen.dll.tmp	UPX
behavioral2/memory/2332-312-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/2332-312-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encodings.Web.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\DirectWriteForwarder.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Quic.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\CheckpointRestore.mp3.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Primitives.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Common.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsFormsIntegration.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsBase.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-heap-l1-1-0.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Input.Manipulations.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.Design.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\ReachFramework.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Primitives.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationFramework.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe

C:\Users\Admin\AppData\Local\Temp\6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
"C:\Users\Admin\AppData\Local\Temp\6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe"
1⤵
- Drops file in Program Files directory
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
47KB

MD5
9c9e664e147664c0c01f70b4fcecfa38

SHA1
ab25f4850878c61a4a9dec8cbe6036a2875733cf

SHA256
a3b367ccca0ee61e465f9787930eb22f0c701e96d3c94645e1b32839419bafd6

SHA512
d71949580e47d50a70ab3f19cfd7d924427100018c05855c1f254d7f28ea0746be41b8a0dbaa1ea06941a6d3c2fa945799c7811126f07ee3fe9e431cb82c5b9c

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
47KB

MD5
acabc6feea2412b68bf3fd6a12f2cdb8

SHA1
fe713118471e67e11665820e823431f6d3590ddf

SHA256
15b53d2464a1be6150abf8057f5cb3f85c347928e172fda32e335b8a80059c8f

SHA512
98ce01b589e9ae4d5ef9df301555a8774bf02a786bd24b6f242b7518afc8a85ac2321e6c03d4ef09485c043a0a3d8bfbbf96efcb03ccae243b0f68ef36c0f0ed

Download Submit
memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2332-312-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads