8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33

Resubmissions

03/05/2024, 00:22

240503-apehjscd33

02/05/2024, 00:23

240502-aptx8sde869

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
Size 110KB
Sample240502-aptx8sde86
SHA256 8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33
MD5 34468407e6c8cf39c6d31ff3ffe856db
SHA1 8e172f0f0305c9edc508a93852b06ac36446980c
SHA512 e49c53f459588ce7103179182bea96d2d91df111fea4581a0482ace621e57583f37441aeac7c2f5682064336c8743bd6b4d252f13f333ecedde8290b13bc60fc
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz3:RqlIyFESWu0SWuGSb
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1303) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Primitives.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationCore.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\ExitRead.csv.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TraceSource.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Primitives.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Extensions.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationTypes.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-string-l1-1-0.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorlib.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.Primitives.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Json.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Quic.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.Windows.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationFramework.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\ReachFramework.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Ping.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Accessibility.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Native.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Xaml.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationProvider.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsFormsIntegration.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsBase.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationFramework.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Pkcs.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationUI.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Contracts.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Xaml.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Input.Manipulations.resources.dll.tmp	8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe

C:\Users\Admin\AppData\Local\Temp\8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe
"C:\Users\Admin\AppData\Local\Temp\8d5727bfd9464f4c09b38b5daff3da203487d9a7bdc1170a994c939a97dc7a33.exe"
1⤵
- Drops file in Program Files directory
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 110KB
SHA256 2cd1d25ec2d8fbcb49786bc5fd248d4941bfa8adc2523520618b0f96e4402709
MD5 27ce54883d5824c22b8a9b558cdde3eb
SHA1 20a2a0d8318ca608a6748e43a2023f4dfbea69e5
SHA512 3ec2a64595e686ba610f6c890b5979d17b9008afbb0d07025c51e9b15a70bd534e4498de851ff4b468e48910be50f8cd60149287fd324e9d866217cf70688be3
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz7:RqlIyFESWu0SWuGSn
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 110KB
SHA256 2b70522c6bb6bc07d40a72e9d5f791169efb2cad0806ab35d07784effda1998a
MD5 8401f15355b01778f5087f15ac47e2f7
SHA1 3544c0761fe2f113cbf846412487cf33ef9f1af3
SHA512 841574ef0ec51860b279d59d21bc15d83ba66704705b5d5fea20921ff6e6dd43ffaf58df174102c6a1548371c2e015e02d38ea348080635f994747ba77820d40
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz5:RqlIyFESWu0SWuGS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads