487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
Size

109KB
MD5

8e462bd8616c756a4700794428a6aa33
SHA1

64e713d01bc4bbe63b0017168aba4fc35654fd35
SHA256

487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc
SHA512

cb4f0e0c59603f69b4f8d0e37983fe363b53db45d6badddec3b135d5a570bf6df1f5d01bf4c44172993c3ffd465a9e3239d03577700b6e548caea418ac5aea5f
SSDEEP

3072:6rWpcOPxPke+e3fFpsJOfFpsJbgE2GEJdwJd2hUhz:tFPxPke+eI2G2Oz

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1288) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.IO.Packaging.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Design.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsFormsIntegration.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\hostfxr.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Input.Manipulations.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationProvider.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Buffers.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Extensions.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.Primitives.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClientSideProviders.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\PresentationFramework.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\ReachFramework.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClient.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClientSideProviders.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationTypes.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Design.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Watcher.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClientSideProviders.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationProvider.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Controls.Ribbon.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe

C:\Users\Admin\AppData\Local\Temp\487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe
"C:\Users\Admin\AppData\Local\Temp\487a2a20eed555be0074e819ebe77285587cfb759d9be6fffa7bbd69867b30bc.exe"
1⤵
- Drops file in Program Files directory
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
110KB

MD5
b88f1887957dc3cc0e3c72a9d7cfb313

SHA1
e35fa60d2262d818775d08025f3edf1ad00e7721

SHA256
f70b953f203b7c4dad04ad39f5d8781e44b4996d5826d335a2dd43459f79ab74

SHA512
f405bee9147af3fa68b3071bc871df906b16ab32bde9b709dd52e95013633f070b7398a8edfcf3c0f97485cdec55dd056c990573ff3d081bf5a7af11fff755e5

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
109KB

MD5
e7953decc9c47e6adb6e5949fc72944f

SHA1
a03ce43588d48ca01941540967632f20488564a9

SHA256
bf13b2554fd852e43b9249a9edf094770de9e597c8cad17bd166c2eb0208a4f5

SHA512
9b5c8299b2e401d813a20f4360e9fbedf74fef67b79ffaea013855a5438107c0e0e617bd3078866ea10eb7868c9b7bfd594179875b7a8808b8f3b16520de7c7b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads