6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
Size

86KB
MD5

d28d19fa1736c5e3c92c92d8328c220d
SHA1

8eb4277d032a73d655138be5c888cfe91dc3b7b7
SHA256

6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155
SHA512

ec87fe88fe5d898755208c14de0adf6b1106cf73b8137fde3cfc7e60c05f48c3f0b3f8ab932fa217db5287bd2b01d18b1d69bd708ce610b90837a0f980dfe600
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiDGugs:fnyiQSoWgs

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/536-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0008000000023246-2.dat	UPX
behavioral2/files/0x000400000001d8b2-7.dat	UPX
behavioral2/memory/536-426-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/536-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023246-2.dat	upx
behavioral2/files/0x000400000001d8b2-7.dat	upx
behavioral2/memory/536-426-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Annotations.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Xml.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationCore.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.HttpListener.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXmlLinq.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Numerics.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Presentation.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationFramework.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Watcher.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Xaml.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationUI.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Design.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Dataflow.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemXmlLinq.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebProxy.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationProvider.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\ReachFramework.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClient.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.Primitives.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationFramework.resources.dll.tmp	6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe

C:\Users\Admin\AppData\Local\Temp\6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe
"C:\Users\Admin\AppData\Local\Temp\6b953222e142af2b0afafeb28007b3f3d991263e00ce1de4828032e324b31155.exe"
1⤵
- Drops file in Program Files directory
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
87KB

MD5
58e8797728a9000b76a4e1586e0dd66c

SHA1
659b1a8b4a70ab18924b448ceac89107526011bd

SHA256
a1c298b8f640bfd9fb368c10fe7bf3b6fdd6710dcc6d36bc205de7b50e1ad7dd

SHA512
d0b7983609e9fef0a2bb6d9f2d813d18c0fde0441b9c9effa3a1d5bc99700c46106253173554e3a3d6bf247e349a16dfa62ef652415812c447f65d9e3fbe754a

Download Submit
C:\libsmartscreen.dll.exe

Filesize
86KB

MD5
8523b504dd117e2fbb0fa591e2a3cfd6

SHA1
07ac1c0124a386c801cd28add8120fde1bfe729b

SHA256
c8f08b0319d8c33c6ff2ea18b1adab343e08ee2dd1978ff84ebaa661f9bc0174

SHA512
239e94af414122358040259f794ab659ce9571574b61baefc83039ae7f0b2f727f9393499e15e6a9898abcd46ef1024244adeabc641c6af9811c9d48209e3213

Download Submit
memory/536-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/536-426-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download