4f6b371a18a7a9d2ae9248a680b3b4c346377001c2bc3bed7d4214cbba9128d1

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_98339214c74067e716cad4605ad28f40.exe
Size 71KB
Sample240608-nddzjaca33
SHA256 4f6b371a18a7a9d2ae9248a680b3b4c346377001c2bc3bed7d4214cbba9128d1
MD5 98339214c74067e716cad4605ad28f40
SHA1 e259be75e2e59b81f9c1a38f5dafb64063f91f76
SHA512 54e90b0e63c6c5feadfebcb3078d7bb93a0ff3a8c94a9808c32d2f5f2c65822770e4c8e1d5a453006fd534f50bc10cfbe151eb4441e350380060fc8d63e4ae13
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q80T7:+nyiQSob
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1848) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/392-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000f000000023244-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/392-418-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClient.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlDocument.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebHeaderCollection.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationFramework.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Serialization.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Xml.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceProcess.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationClientSideProviders.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationCore.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsFormsIntegration.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\WindowsBase.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.Primitives.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationCore.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	virussign.com_98339214c74067e716cad4605ad28f40.exe

C:\Users\Admin\AppData\Local\Temp\virussign.com_98339214c74067e716cad4605ad28f40.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_98339214c74067e716cad4605ad28f40.exe"
1⤵
- Drops file in Program Files directory
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 71KB
SHA256 46a95de7065af4d6864ef34ee0115ea5a31f719dad3c58f998407f104776f0dc
MD5 3bebfc1a2a4de8efbc9bc3106ea86eed
SHA1 4e291526316ebc80b665d979e8a7cda6e2b1e6c0
SHA512 019f70e2878fe1763d51474b35e62e53f576d8c36fa731268672dee45492bcba02dda02db0a1a7fa6e36d42f05a7286370cbd72f6f19dc6c86b7223d90e212a1
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q80TA:+nyiQSog
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 71KB
SHA256 3e26b553a069272a9804de9853514c11ea76683b27a9b704c52c6dae5a6d4603
MD5 45a0ebbdf033b01a6675c12bbdcb5ad3
SHA1 d464ac4ab7296da5be68733d141f4575b013b475
SHA512 333e2d03ae5cf4fb80a6bd8c7030829ea1ef8e5ab4aa785e7dadf57e3895fd5dc74b4b17ab8dc4e0ac302d6d09c6c7bfa0662abc272c4dfcbb87875e0ec22c4d
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q80Tl:+nyiQSoF
MD5 SHA1 SHA512 SSDEEP