dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d

General

Target

dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
Size

69KB
MD5

8dd91e7c05fb171bd9662d596fa5ef21
SHA1

bba6dcad2ff982d202c6956d28a2c6d7e587fdcf
SHA256

dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d
SHA512

3403a014fa592efde89e86e28dac46b4ed82230c0d42e32b0d2bc055e52f8146826fe127e6c5fb5634bd0af6f30ce6576798fd5d3792e6ea893f7bc9cf96089c
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tp+B:6e7WpP9oVLQthbYY9oVLQthbUrt7t2

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1833) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationTypes.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationTypes.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationCore.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClient.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\InvokeSync.wmf.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationUI.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClient.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Xaml.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClientSideProviders.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\hostpolicy.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClientSideProviders.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Primitives.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.Linq.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationFramework.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Registry.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.TypeConverter.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Design.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Xaml.resources.dll.tmp	dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe

C:\Users\Admin\AppData\Local\Temp\dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe
"C:\Users\Admin\AppData\Local\Temp\dd9b1cbb85d7f946bb8a8d83f9d1aeac5878c8d580c0707b4c50dab18d36a28d.exe"
1⤵
- Drops file in Program Files directory
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
69KB

MD5
5bd97bbe6538f8803734ba795f4292c4

SHA1
8deecce2db3220ce831154f675f44a739ca1cab9

SHA256
1c80da0e23d56b0f8976383dcaa68ff531d0b26fb572ddb208e543a2464e06ef

SHA512
390283206a9ea429ce383f669467f0f2325a104bb3339bf736447bda943c255294865518608b3f7667873359ab3bd8f4ba6b6f18d4f4de97a2a5880d190dc26d

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
69KB

MD5
0a2588b15502b67095f33b242df91f44

SHA1
b35b44a99d68ba8b99fc8542d9c0c2267c205b6e

SHA256
cb99b28ed9cf70e909306057d5e074dd7f14bb8867b8daaa376856a7a495261d

SHA512
e1ff74584260f82534e302b8cd76fa5e630f71e56b6c95912d4f7769386857b66db913335194911656b15137ab469a288d658e82ee6839339c2198a9cc7496f8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads