e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
Size

75KB
MD5

7c5d1748c0c4c0f1d61dbe3deba07277
SHA1

b8b18966d77e416dcb4560d7a0e8987082fdb813
SHA256

e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58
SHA512

33e22bb7880ac966d6c18170c4bde2b6026edcc8b36952a5dde2016249b395602eaeb8aab277d00a0a26be6fa36c15e71aa89e96f9fc9b3cf4ae171cd2ab5213
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJf:+nyiQSoR

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1078) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1480-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000f00000002325c-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/1480-430-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1480-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000f00000002325c-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1480-430-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\ReachFramework.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationUI.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.TypeExtensions.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.AccessControl.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClient.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Controls.Ribbon.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationFramework.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Ping.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationProvider.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationUI.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Quic.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrgc.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationCore.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsBase.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationUI.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-2-0.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Transactions.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Primitives.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TextWriterTraceListener.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Expressions.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Xaml.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationCore.resources.dll.tmp	e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe

C:\Users\Admin\AppData\Local\Temp\e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe
"C:\Users\Admin\AppData\Local\Temp\e93c6e9ae2c785f1b984fe6108a4ff28060582ebbc00e30a85e24d4986f68a58.exe"
1⤵
- Drops file in Program Files directory
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
75KB

MD5
fdc5ada68ef68b99e0d2564b14fba268

SHA1
5e10337500e6f563d599892e6684d837f8db125d

SHA256
48fc8addcc517691c84ac94d5885305965b61febd0d95ec6eebf75096661e7f5

SHA512
8291d6f044f9289c7366f32bc9b1d02abeebe2252b087993264949c5bb6367df04ff6647377b82e0dc2df1f013f44ad7e341745a7ab439bee0d1b6fefe7f2363

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
75KB

MD5
51df8396b97d4b1383c1fc99766fa5e0

SHA1
2e531bd7f585b467268903722cfae4d4ffa8a6c1

SHA256
d72164952e2b71585331796c9792050e6c85b6278719bca0b2dc15705d49a095

SHA512
29bf542f7015c007fb7f925580ebb6ab16a66142ae00e6f356ad5028c4ac696109f908009a230dd6dde8c05a47394e73e6ab79a75820aa6e1ae1a805a38f93a9

Download Submit
memory/1480-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1480-430-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download