51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711

General

Target

51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
Size

68KB
MD5

15942c58a848f53dc9ff00e8d63263b1
SHA1

b99e06a922d4d18a6b789d85281523a8688a418d
SHA256

51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711
SHA512

9d0865591959df4b678c83cb8932be8a3050befd98611c1da2dafcfe7bb145b7b561612c1ff471dec4f6c9d66cab546c7cf406bacbac922878bbc97066c103d2
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/R:6e7WpMaxeb0CYJ97lEYNR73e+eKZR

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1367) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.CSharp.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationUI.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationTypes.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.25\hostfxr.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsBase.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.DispatchProxy.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationTypes.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Queryable.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\netstandard.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Pkcs.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wpfgfx_cor3.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Serialization.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationProvider.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\.version.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Input.Manipulations.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Design.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Primitives.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Input.Manipulations.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.SystemEvents.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Extensions.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Input.Manipulations.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Design.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.IsolatedStorage.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorlib.dll.tmp	51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe

C:\Users\Admin\AppData\Local\Temp\51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe
"C:\Users\Admin\AppData\Local\Temp\51dd9ddc6cd334c06feb95766322bb60e09dc23dea50484f910dd5f063720711.exe"
1⤵
- Drops file in Program Files directory
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
69KB

MD5
7ce7cf261fae66cb77f34fe135beb455

SHA1
841d8429617685896059cb5896665541d0cc8c71

SHA256
c94d54f1adb37caa7dea787adfa08c5f35e06eca64fa6b9523b1599511ed074b

SHA512
9108c8ad30c5c5fb35a7aee14792432ed38df1c33c2b3a9b63ce7e2d1161253c0a45579a02fdd00e3faad55f69cad51bd97530ad9bbfefb0a97a31a7032dd1cb

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
68KB

MD5
e2ba8274fe1a265df7754d472411b9d1

SHA1
9851cee4c19a4f375778a98f7af4cb2da4501ca3

SHA256
20afd0dc5b196bdd44ab1f8d6666d8ea8dcc2cfcf63c7e7f4d046e566d0394f7

SHA512
11c3fd1887c6ee99fa979850786ca7b792949b7571c691bbd55c34678e898092332bd85efb36b40989bff38bb328bbd7abf3fbdc1469ef29423f15f7d937883f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads