8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
Size

259KB
MD5

c42521bcb6599ccb6d73f592e4ba6b73
SHA1

4f8e686d03c0e5af46cbf382a186ccf0f606a100
SHA256

8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9
SHA512

e7c3d00bbe77ef52888e0377818d7d5c4e3c315b94930f3e141a47e81519c3e57028c73cf7170bd67f80354796e32af4b64eec371ad4c0ebac40ee2c705ea9a4
SSDEEP

3072:fnymCAIuZAIuYSMjoqtMHfhflixizfAIuZAIuYSMjoqtMHfhflixiL:KmCAIuZAIuDMVtM/xfAIuZAIuDMVtM/V

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (847) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/372-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000900000002326d-2.dat	UPX
behavioral2/files/0x000400000001d8b2-6.dat	UPX
behavioral2/memory/372-288-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/372-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002326d-2.dat	upx
behavioral2/files/0x000400000001d8b2-6.dat	upx
behavioral2/memory/372-288-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.NonGeneric.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Configuration.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\ReachFramework.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationProvider.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TraceSource.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationCore.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-process-l1-1-0.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.AccessControl.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Handles.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebClient.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe

C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe
"C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe"
1⤵
- Drops file in Program Files directory
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
259KB

MD5
9fd8ee676535b03166100856d1b76ad1

SHA1
e34d37476ee7de8dcca6053500fcef656d1734f1

SHA256
aadb3556e58da6cbe76db9caef2af206e8b5ceac39f359cfbebf2229c213cd57

SHA512
577af81dd8bb8b53e8743a73cdfc64b48b387962853537ad3577aa66be717e6b38a06238d09d85ff421ca63996d631ee253fe2baa1baf8624f12d814ade01569

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
259KB

MD5
875128111de2db6b6b847afd10b10190

SHA1
2e664791c225773fd4a4c66df628c0bd484b0b37

SHA256
e3490b74f5085df9acd9d201413205ceec38ab8fed8ea3b8587ca5791371373c

SHA512
a8b786d05f38da148974efeee1b49976876e587de198691c80d44129b13d314d3d44fcf5c233e04ffe88de620249fed705873c33f626ec6b009c3c26edd1e546

Download Submit
memory/372-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/372-288-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download