b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37

General

Target

b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
Size

140KB
MD5

0e581cb9ecad0ed77c2e0dbe1e6edc38
SHA1

77df408a9a1fd79c594727f945beb9976ed54f24
SHA256

b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37
SHA512

9928f0cf81daae1ba30fb79a2f098a88e1037f3f6c3944b7bc395def4883619c639b480b6591e8091fa4e11623aa48ed99e067c24de6b013fb2c5a989c84af99
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCD:+nymCAIuZAIuYSMjoqtMHfhfmUlk75X

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	UPX
C:\libsmartscreen.dll.tmp	UPX
behavioral2/memory/5112-354-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/5112-354-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encodings.Web.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Input.Manipulations.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clrjit.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXml.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationCore.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.IO.Packaging.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationFramework.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-private-l1-1-0.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Primitives.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Input.Manipulations.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\ReachFramework.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClientSideProviders.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-stdio-l1-1-0.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Registry.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.Json.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsFormsIntegration.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tools.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebClient.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.AccessControl.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Design.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.PerformanceCounter.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationProvider.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.tmp	b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe

C:\Users\Admin\AppData\Local\Temp\b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe
"C:\Users\Admin\AppData\Local\Temp\b9b772b1d0b327a5c7f6c4753b634e28a3d257af49d33c0487f40f7d0fc68c37.exe"
1⤵
- Drops file in Program Files directory
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4016 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
140KB

MD5
b0511c2443bcf3a8fef18b47a200afa5

SHA1
fdb4a6b4ecc3b1a48c469d794264202dcea478e0

SHA256
02290b588a6e9bf77edc1e3a35f98296c8e4a373056803ea44cc278ccc1d2b82

SHA512
22295bc120b7a85d30202dad205c7a01a4b1f54784e38e813f503e0628d081c58a42ff2dea05c0ef1e62fbc9d130c6d854d335dfd62dad1e32b2f6d7d1133519

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
140KB

MD5
401c927bc89b91b97646d73512f52f56

SHA1
d49666aabcf79b7775a6b6d6e7f63e27ae261453

SHA256
a225a804959343a112c07301ec1b3e17383c4d6e07a4b2568f5c875bdce4ad82

SHA512
3bb18656d56da1f259bb94b9153a87e7568c79c4ac0c7b72f79da8fcbfa4038bf6b6ef5019679c814374df2dee8957168567ca669926b5d202a8d2db727a00ef

Download Submit
memory/5112-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5112-354-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads