f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207

General

Target

f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
Size

70KB
MD5

c248764eb8a4eafdf4e8b953990c42ad
SHA1

fc1081315eb3cb935adfc68e27a442c7439f3a5a
SHA256

f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207
SHA512

559a71c166452ce1e4389f907ab292bcfb49d0e70f8ca33fec33d11c0d27ef51f45b02d956b8f1a8a1cb70932d51a226622b4e35e98821e6b116ae5e83834812
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7trym:6e7WpP9oVLQthbYY9oVLQthbUrt7trym

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1720) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.IO.Packaging.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationProvider.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Primitives.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\DebugSearch.m3u.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationUI.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Primitives.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\ReachFramework.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationCore.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Json.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Primitives.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Input.Manipulations.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationTypes.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationTypes.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Primitives.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemXml.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-string-l1-1-0.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Xaml.resources.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.X509Certificates.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe

C:\Users\Admin\AppData\Local\Temp\f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe
"C:\Users\Admin\AppData\Local\Temp\f5db075b60f3761b0fc0680550adbe16ae73282730fac1d10acaa18246538207.exe"
1⤵
- Drops file in Program Files directory
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
71KB

MD5
b2cfc0b2d88af0fab9229bdb5c9fd213

SHA1
c2181a2500ed44ecee5b362658f82757c8861991

SHA256
44dcf426aa0822c49c73b10b4688fadfc3ea7ae80192a229580f5c2b797430b4

SHA512
768c1d80a0acb3c6b47e51fb2e58f443878bc27cf9fd074be81befc96b070a29450105f96cb03dc56fce377441f5f81a837384159d5758cd1457302e07b000dc

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
70KB

MD5
97381e726efdbfc84422fefdf6bbd004

SHA1
07e0b652b10564bc482752a4df254001b4b21a56

SHA256
a5001a5af4536d81355e75b25446f81febbb5adee776352277d8b1d7cf65e5bc

SHA512
706c44c1de08c9f7c280066a3dffcab0d53ddb7cd0fb6fd4cb009e88308c7d3379544b6467f3f87199374580b7dc808f52d88c3f953bca14184a4718fc88ddd9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads