c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364

Analysis

max time kernel
153s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
Size

93KB
MD5

3bf3a2d0d670873d5d01d8d7f890f288
SHA1

7b38a6ce34ef0a637531f59c0dad89793a6807ea
SHA256

c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364
SHA512

b29f94bcee7e200bba6c7a1a916dbd0a0f87f78585dab2859864576276aba0b326413d412b9c5fbe8d25d7b7374f65571c9056caa04a7fdce853f6cca9085a2c
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP76PDn+I+q:6rWpcOPxPke+e3fFpsJOfFpsJbgEODV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1359) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.ThreadPool.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationFramework.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.Lightweight.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationCore.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Primitives.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.SecureString.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Primitives.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationFramework.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Parallel.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.AeroLite.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Threading.AccessControl.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\WindowsFormsIntegration.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Xaml.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationNative_cor3.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClient.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Xaml.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClient.resources.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorlib.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp	c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe

C:\Users\Admin\AppData\Local\Temp\c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe
"C:\Users\Admin\AppData\Local\Temp\c8f6e74a1f7332c4296bd14110d74da47eb6f3f61f1b24806565a903ff7c3364.exe"
1⤵
- Drops file in Program Files directory
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
94KB

MD5
e766fe4d986b12a1b87f1b3f4661def4

SHA1
2053c2866e50d28781b2e0a37b444679ca2228a1

SHA256
1476c048a02e7d6e65dda854ba4298e3ef076445230e027ffbd1e2a0358bba6a

SHA512
dd735163258d862b4f3c1fbc6fae6a369f722c6d6ebc4a5fb536fa21a217f82c5000af7b3cc98e2883e2c3f689f5a4fe06a40ae697fe3bc52db0c68154b61cfb

Download Submit
C:\libsmartscreen.dll.exe

Filesize
93KB

MD5
bd901dfee630ac52fa3c8169150d96e0

SHA1
f3839c229ba550dc6689f072fa1ab8efa7b997ce

SHA256
17d677ca8ea264f1d378d8238efccad86949218ba6a43c4a0c8bb75f3cffb419

SHA512
d688d3023b6eff1d2211c9b4cda372dd651eaf7512af2c3e7ad22b71af5b3984ecea1620ecff357dab4230a978c1959e97dc3229c2aadb03dbb37fb085ef0889

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads