f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
Size

49KB
MD5

42032e6c0a3efedd7dd1f27dc0f2548e
SHA1

80515f64669ab772f5df9ce1b430fb31240adf7f
SHA256

f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323
SHA512

cd2550cd5fe4ba3a63ba33c70b137af9bd40a6a735983d1109c34ab1f2f8530e3badd7870842cd7e6fce23262f10285dd95da2df1c1a222a32fb94dec938383f
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WZCqCb:V7Zf/FAxTWoJJ2WjWZCqCb

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	UPX
C:\libsmartscreen.dll.tmp	UPX
behavioral2/memory/4248-434-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp	upx
C:\libsmartscreen.dll.tmp	upx
behavioral2/memory/4248-434-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationTypes.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Xaml.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clrjit.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Uri.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Buffers.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.Common.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Transactions.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.Extensions.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClient.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebHeaderCollection.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Overlapped.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.AccessControl.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationFramework.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Primitives.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.DiagnosticSource.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe

C:\Users\Admin\AppData\Local\Temp\f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe
"C:\Users\Admin\AppData\Local\Temp\f672cb38d2ce432c8ddc2ac281ed158c838465da3427902b630ed3f08e8a0323.exe"
1⤵
- Drops file in Program Files directory
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
49KB

MD5
ced6ac2e71989aad41a6b56b8f989011

SHA1
cbb7284e57ae1370b3d4d349ad027111c6e76bdc

SHA256
c0f80ab9d60fff5a2ffc86b877ddf7e5b84bfcf27006a5e6d5220792925b8654

SHA512
0f2c0334df577c5944c46f7891496411738bdc93772fc80f27a89ca5f10342cd8857f74560a251cfd3050440eac4ec4130a97c14f2ea85d446f9e44d0e1a424e

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
49KB

MD5
9230246d2f68e7c34699a2ea8c219f22

SHA1
bad0b69b9e98f13a8d964fddc2ec99e20431b233

SHA256
28b0c4552bbea22998ac32f667790d48832f55259ce7e4568224298f9ecd6561

SHA512
e10c1daa911906e7fd47cbfa9c000eece65ff4af40a65e6582d3dee99dd29cbe9daf7b8798ce1523143123a7714d1474f3f1f5b2551a38636cbdbf435e85521f

Download Submit
memory/4248-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4248-434-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download