cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576

General

Target

cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
Size

68KB
MD5

568c2ad59b51a95eb3dac3cfadfd6604
SHA1

3780121e4250fd15edfb3a98e427b6b2dbc415a3
SHA256

cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576
SHA512

a1be5210c7c026906d0de218023887a2e625dfa6f6733766506d10ab3c86406801424a92534a0fd569eb687ed9c72d5bd09b51e6bcaaf0e7d7a4ed75a67d5692
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh3:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs2

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (929) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.Local.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TextWriterTraceListener.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.HttpListener.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Claims.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Forms.Design.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\msquic.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationUI.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-heap-l1-1-0.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationNative_cor3.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.Vectors.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationProvider.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Immutable.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Xaml.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.TypeExtensions.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlDocument.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.Design.resources.dll.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe

C:\Users\Admin\AppData\Local\Temp\cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe
"C:\Users\Admin\AppData\Local\Temp\cbe04d5330c6386a67f56e0ab939b5e58dd1ab27b6b001a02c3d22de3a64d576.exe"
1⤵
- Drops file in Program Files directory
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
68KB

MD5
56e41786302bde5322f7a5a8a6f29f92

SHA1
720250657b4c7101b099daa06c7ae822b3ed97da

SHA256
71a6ca5fe9000d965a0fbd84f35ec3311fe73bcbe34b802116d8d7cef87e2861

SHA512
402636970b0b3390097309169120af69e871ab4aa160650a3b413c40960465420463e0be05366842c0a46100a06b07ddf63216e05a28b950effd8ea49216a732

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
68KB

MD5
404d59d220c920bb10410a2c0dc38555

SHA1
89518f2981bd2072bc6f525ea1919bf395595e07

SHA256
54b96ee0f104920a638a70fdd5c89e390ba95ff1570de687e7946c33d46f4de7

SHA512
7b7329d475bb048c96af06fd27f553dd33c7bda2d60e21c4dea89502c1536160c5dfbb5bd4b5052a5eb137b04f46fc9cbffb14ebb26f12c0452b9d3ecf3086ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads