b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
Size 82KB
Sample240609-jfv9daff9t
SHA256 b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a
MD5 709fc125f8fb9959df7d4ec7f30a1821
SHA1 081dbaef3e89c66ea28c1606a6346ed03773ade2
SHA512 40f7d013df515efff14396fbe36a913495044ccaaa983396d186c77e4ac39696c70f01c461da7391e83c68cf7d98ed4e4db773a1ea335b6c7f989b69465d9a54
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJO7:fnyiQSohsUsS
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1830) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2620-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x0008000000023263-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/2620-438-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2620-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023263-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/2620-438-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Xaml.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TraceSource.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationTypes.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationFramework.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsBase.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.Forms.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsFormsIntegration.resources.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-heap-l1-1-0.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Primitives.dll.tmp	b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe

C:\Users\Admin\AppData\Local\Temp\b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe
"C:\Users\Admin\AppData\Local\Temp\b855b414cf8d3fe0195a237c0bbc0c7fd1fbd4a5eb7fca3cc74ad345787e160a.exe"
1⤵
- Drops file in Program Files directory
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 83KB
SHA256 459bb9753aad60e2df1b6da7f884631cf9b7769b99796987c1368d1f8750d12f
MD5 348c550fe95e6998c5dfecc4ec03cecf
SHA1 9646081a3720b2d9bf0ea24851eeb5c20f183104
SHA512 6d340e81e8132308e51f3014fe3de869b503c58d0bf7176f039aec0f49ca427193af70c9df51691933d7dad36a49ba775a74c50e20ace81a10bc898230203864
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOl:fnyiQSohsUso
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 82KB
SHA256 1497a460cb3650099b721e9ebf17714d5a194a4c0b6afca28bb8272556ad483f
MD5 7933d9625ca03c611a15be1a5262f234
SHA1 72ab201953a54ce730b3d4c7959904b575ba29cc
SHA512 d8a01557f28ff2b9bc4b71235619a763650a03b68b20e472b3aa7f88697a8a1d865a070b793a42ebcff92dcd8c8ad837d8a5a5a25cfa75e00215d6ad6e5f06d7
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOI:fnyiQSohsUsp
MD5 SHA1 SHA512 SSDEEP