93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea

General

Target

93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
Size

124KB
MD5

a98eb48e641dca4135b49dbcf1654aa8
SHA1

59e845ca10047ada1a7df5500cab59fffb271fa2
SHA256

93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea
SHA512

d0e6e85efc7014c4d68635f143d43458da14ab6a86f6ddd3a4e6c227ad85edaac3f0e09c76626dd8d6f69932263cf13a2827f4a79d50ae25f05b8f824e9270df
SSDEEP

1536:W7ZQpApjIZNdNnfFpsJOfFpsJ+n1k1jWk1j7:6QWpkzlfFpsJOfFpsJ+n6jf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1523) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClientSideProviders.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Primitives.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXmlLinq.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\netstandard.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Parallel.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationCore.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Registry.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.Json.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationUI.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Timer.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.0 (x64).swidtag.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.Vectors.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationTypes.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Extensions.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationProvider.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.PerformanceCounter.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Xaml.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tools.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClient.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Design.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClient.resources.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe

C:\Users\Admin\AppData\Local\Temp\93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe
"C:\Users\Admin\AppData\Local\Temp\93fd4a2cedc3aaacda35cc12a58bc1e04df56794fdf169679b9fbbdfd9968eea.exe"
1⤵
- Drops file in Program Files directory
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
124KB

MD5
4b747de82fe282b6891a0fcbbf4bf0d7

SHA1
15a5145a2189d337878741ee74568e553d5a8672

SHA256
b9ae3b99476815ba5997cf9e0895c604df78d6469e9e473353e1036673b48281

SHA512
e0298ade16fc9599306dca8301aea317c51b033f5bd4a47064116ba30443310ddd4fd8d7d158bc87dc8f8df46ee8bf56d653258867c5072825a8257bd3a3e63a

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
124KB

MD5
8cf479bd04731c63739736aa2a18f290

SHA1
d0a62e4779012cc4e6a7eeccef45dd265ac446d2

SHA256
c7660587a643b8fe0d1c6391f4e36558961b1ae690640c3f803ce95fc56b1626

SHA512
d5951d3813a96877e5e629a87449a89cf8ab16fecc5505a06a6cfc2d2ad2135ba1313c13e92cf38f0bc6bfed51c98fb53a5fa61242669972f22550cad5ef5d55

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads