Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 04:52
Behavioral task
behavioral1
Sample
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
Resource
win10v2004-20240226-en
General
-
Target
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
-
Size
104KB
-
MD5
6f4b1cd0d7c5b5ef131cb3622ef4274e
-
SHA1
122a24579eb484babc6f72b10bdeb1d89ceaed83
-
SHA256
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a
-
SHA512
575f501a3c45e9b8c8175be43d84b69fe21654fcc1ee0ffe6f279fc05a55e260bbb3102252070248261e99c7b0c08479485466c124e2ca047b98cc68ce5e4468
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxFy5gfcL5y5gfcLdddYzpcl/DOkBruq:fnyiQSoXqeaqed0zgTCnq
Malware Config
Signatures
-
Renames multiple (1552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2388-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp UPX C:\libsmartscreen.dll.tmp UPX behavioral2/memory/2388-432-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Processes:
resource yara_rule behavioral2/memory/2388-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp upx C:\libsmartscreen.dll.tmp upx behavioral2/memory/2388-432-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationFramework.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationClient.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Primitives.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationCore.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Primitives.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\ExportSkip.temp.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsFormsIntegration.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.AccessControl.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationUI.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.NonGeneric.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.Win32.Registry.AccessControl.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\coreclr.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Xaml.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClient.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationFramework.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.VisualC.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Design.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe"C:\Users\Admin\AppData\Local\Temp\dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmpFilesize
104KB
MD5dc908c0ec1200106c9c76a6a1ffc99a2
SHA1b373a2d20135d38cebc973c6454330b53a8adc05
SHA256832bb022439784570662409e14ed928d769673c4de9ea1273a856c668415b3f4
SHA51206c4a46dedcb857ca04f603b45d2040cbf74b3ef096a692aec4cc69a2e66c6c1afd2444fc7d27b7c502af1258ce2333e0dc0ee83c2cb4f4614f519820438596e
-
C:\libsmartscreen.dll.tmpFilesize
104KB
MD572df825a9aaece85d5fe8e5dafa36759
SHA1e3afe143f45aacad1955c4813cc063ab9196f7e5
SHA25611e2269db34e1a12ca3eeb205b052bafa1d8b215f825b24deaab043a8e7d92bf
SHA51216ea50b7b3f084b96fbc9cbdd827d33f20a338ea84da2918f71192345d5ecb7a688b709cb0f98d781ce024c8a80c4274c27d1561a0343b1201aa06bc5f9687d2
-
memory/2388-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2388-432-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB