918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
Size

40KB
MD5

fbd15cbdf9e25e212cddd860553ede65
SHA1

9f8676db7c8b3d902891679073cb5a1e94f002b0
SHA256

918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6
SHA512

419bb54ad1d34d29464c32cc41f7c724503ac9927d88260139a32db144bd4b7de81b8f4aaba3b73c52a0fda4eceeabedee72ac1c1136581d3bcd104d1932bccb
SSDEEP

768:V7Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzi:V7Zf/FAxTWY1++PJHJe

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (934) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1480-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0008000000023288-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/1480-430-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1480-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023288-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/1480-430-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsBase.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-2-0.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebClient.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClientSideProviders.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationProvider.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Printing.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\CompressInvoke.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clretwrc.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationUI.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Xaml.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Configuration.ConfigurationManager.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\ReachFramework.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebClient.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Console.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClientSideProviders.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\dbgshim.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Xaml.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsFormsIntegration.resources.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Primitives.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Writer.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp	918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe

C:\Users\Admin\AppData\Local\Temp\918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe
"C:\Users\Admin\AppData\Local\Temp\918c958af7c7914e63314da9d3c78ad13c71a7bdfda76ec57f055dbb0864c0c6.exe"
1⤵
- Drops file in Program Files directory
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
40KB

MD5
c124d6e56fc3961d2ef2c2785343cdd2

SHA1
3e316f627dd420e9bf96a3e561039ef05273cf26

SHA256
41dff119f6e85bcbef12e2a6e8078786f89f832d7d4f7fd7885f37cf6fdd5a0b

SHA512
5a006cd72bbb451a6c9df0177344f68600f66e1fa258d6bb658db7a03b14fdeb9e5dc6f4bf90934b32c0985930377e4c067041f4de8d83803ad383a3e0d2acf2

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
40KB

MD5
9b07c3ab1258241a381482316b200812

SHA1
2aba065c515c4f870ee0f4f1163e7c73e2d596a9

SHA256
07b286dee19f86379ac39f881ba5c6cced287924ce85a51d264663356f974df9

SHA512
498430edf87eb68ca190a2d95e8cd3aa3e755b58a3bedec16b2804eb970b34857a534da1cf85bcf7376abf4975d7e5f6a4bf28663a3738d763848ab75886589a

Download Submit
memory/1480-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1480-430-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download