c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d

General

Target

c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
Size

78KB
MD5

b84e3f150d33c089ddb63bcb55de4394
SHA1

46835cf3a20067d0d5770df5ecede8c57e071c28
SHA256

c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d
SHA512

f8d612e608f0365110cd4e95978b32554acb0b054b3a46da7ae656fb0e7392bfd5cf1d799a605055de87db796fed041203dc063e6b9740feea8241019e42ec02
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/M4X14XU:6e7WpMaxeb0CYJ97lEYNR73e+eKZneU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsBase.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Xaml.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Primitives.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.CSharp.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemDrawing.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClient.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationTypes.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clretwrc.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PenImc_cor3.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsFormsIntegration.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ValueTuple.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.AppContext.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationCore.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsFormsIntegration.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Xaml.resources.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe

C:\Users\Admin\AppData\Local\Temp\c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe
"C:\Users\Admin\AppData\Local\Temp\c408e6d2482ccf10b580973d80351025e687e518484c4c88e98d138a3481228d.exe"
1⤵
- Drops file in Program Files directory
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
79KB

MD5
6945b64435bf4f46d09926a11543c19b

SHA1
063d831d4c32322643ffe89b0231057cf9310bb2

SHA256
ed3d6cb192a00a057bcb75e792a271c9c2cad5ddc284d693e13989b8669aabf1

SHA512
f4c675c53eb77e067a4ef1ddec94b1192efe41b3426022a50bc8d7c939664564deafc3f1daa5391d450a9c9eb9ce035f1350430754d624031ef65b6f0c05e3e9

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
78KB

MD5
ebc944e7cc82c2a513345dc275f46e24

SHA1
3d47dab5918e7edd6cfa0b819f289cbb274ee53f

SHA256
e8ba9ec0a8c5930e3347bf8c11c54c96ebee0b6f020c89ea74a1cf4e9c347baf

SHA512
8c626043998c8210c17a9337eb6ddee999b3c51f5c5896dba2130fe2fc1a8ec53a505f65faf0b1e5b50c2891c2c029559aca3eaac5476fb7fbfc38e089a04bf1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads