9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d

Analysis

max time kernel
155s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
Size

100KB
MD5

9dd412bd82b6a93b0029db83f4516340
SHA1

f9a6d216a7876efe58753a88c0f64380b6339c74
SHA256

9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d
SHA512

495237b028a22abb1ae11880193df66c09d809b566fa5e2851a8eb79d431d29a042dfcf48de9b65a26bccd39118f84fddc33a54dfa7365c829498190592a098d
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPI0ROL:6rWpcOPxPke+e3fFpsJOfFpsJbgEY

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationFramework.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Common.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-debug-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Design.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsBase.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Security.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Primitives.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationFramework.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemData.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\ReachFramework.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Xml.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-2-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationUI.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Xaml.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.ThreadPool.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsFormsIntegration.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClient.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationCore.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlSerializer.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationFramework.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l2-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Input.Manipulations.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.Forms.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClient.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe

C:\Users\Admin\AppData\Local\Temp\9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe
"C:\Users\Admin\AppData\Local\Temp\9cdf0f242848a06c8e5b733c2a064ad1c6e779172575477855c17802848f856d.exe"
1⤵
- Drops file in Program Files directory
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
100KB

MD5
5d7640cf8d5d020ea4d4623e213def3e

SHA1
aeeec5f902ad0321ab974d5d36236fa573bda5c3

SHA256
32f78b217232e089e8b25671fb9c718d27e5865a7b01b29eb478c45a3af1cda3

SHA512
7c7a14650155299ca1d4fc05d1a24d1e9075acc935df5e731b069766f94df5161ed48c039522eb6118421cf3c3e26dc8e53a4cf8fde44302bf1e4cdc0efa95ad

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
100KB

MD5
3f7c1e139eaab02e811130965ecd929b

SHA1
0b67848f151130143c36c2901319e79663854dc6

SHA256
e94693846d5026834aa8fc801b5d72b19107d4e9e2c9bcde5498776199889a1c

SHA512
714125f3200937e24e35b6dbf0f5a94388127bfd609709185b9535a4f90dc52026d694d20e91e395c6d1cd6f176801c68c0a0d47aeca91a088f167ecc3fd0d56

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads