fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012

General

Target

fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
Size

66KB
MD5

484a1ec667a50b308098a4e5cb29de56
SHA1

e51f2d8c895622d984ba4ce311e0a696698257c9
SHA256

fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012
SHA512

a8d242ab20c1cccdffcb74b30977ede72c3d669d023d3dcd41e1d3f2dc7769c500b29ef50179a33034d2a37a52cee1834fbd66128402db44217b4951e8a45973
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q81osbosO:+nyiQSoaXO

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1288) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3304-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	UPX
C:\libsmartscreen.dll.tmp	UPX
behavioral2/memory/3304-444-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3304-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/3304-444-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-stdio-l1-1-0.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationUI.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationUI.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-locale-l1-1-0.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Input.Manipulations.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Serialization.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Cng.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Input.Manipulations.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationCore.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Primitives.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Registry.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsBase.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-math-l1-1-0.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Quic.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\EnterConvert.shtml.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\hostpolicy.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe

C:\Users\Admin\AppData\Local\Temp\fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe
"C:\Users\Admin\AppData\Local\Temp\fd6de325a6cb4725cb642872c12848538c22f209841f76ead9222f6e490ec012.exe"
1⤵
- Drops file in Program Files directory
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
67KB

MD5
2e679acd2970e16f2d2772e1e90c2591

SHA1
13eb46944755203dfa800106eaa7bd662f6e62be

SHA256
f8cd109b3df5d750dc3cf3a24b2da3846705a7d90ba58b2f8eef3cc397aab7d7

SHA512
fc3ece86a23053695ea9597e069d11e046fa75b7ba67f488f0acf413ab5188e212abb454f7dda25acf26019a683c169974117f4fba289f25cc4b5b2446b4adce

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
66KB

MD5
29bb5d1e7ebc4c0efbc8f7a7509088f2

SHA1
23033267d0f48c6eb2ff9c5e8c26b604084ce1cd

SHA256
da0c5868be050bec65c756e2d4403503c1a1b0218e74c1694628521bce60fefa

SHA512
3e49802de5d44e2d09c7fd6a2e438d1c0cb24a7f1194f2f00bf37cc1d6429828683baff1a8a032d820a626f446520749f12f4d548ebc3052b7a0c0cb288518cc

Download Submit
memory/3304-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3304-444-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads