6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa

Analysis

max time kernel
152s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
Size

297KB
MD5

f798d619916a331f47a820e162bb5041
SHA1

85da23937901f6ec0d637227e1adf00598b8da03
SHA256

6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa
SHA512

5c4747dc64a5a29fc26d5e82612451056660aa2a98147ca23a9d5b1770dd43176db6fe84adb8697f9369bae9ec836854d34a14daf1089264186051d9e98dc9a4
SSDEEP

6144:RqKvb0CYJ973e+eKZ56itOImvjngu7/BRXF8z/LYIXiY2+8AFM:vvbxYX7Z56OOrvLLe7LYIXiY2+zFM

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\DirectWriteForwarder.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClientSideProviders.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorrc.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Watcher.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Formatters.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Extensions.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationProvider.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Xaml.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.Linq.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClientSideProviders.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsBase.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationCore.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Accessibility.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationFramework.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Input.Manipulations.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClientSideProviders.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClient.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Pkcs.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\WindowsBase.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClient.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.ProtectedData.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationCore.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.VisualC.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.25\hostfxr.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.CodeDom.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.Design.dll.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe

C:\Users\Admin\AppData\Local\Temp\6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe
"C:\Users\Admin\AppData\Local\Temp\6622c17a7fedec104437121645388fa72586a7f158022c6ffe0bbf5e9f0071fa.exe"
1⤵
- Drops file in Program Files directory
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
297KB

MD5
bc51488c1f2dcc95f6184eb823346b6b

SHA1
65cbaf7db5d86439a095fa7bf8561738d4da5f5c

SHA256
43dbf735ea488ca4204dc1e1a5553c6457f39dd97ac2467f917508d4967b5f15

SHA512
ff55022cf49603dc2085da6a273c65fdf814665462e03a020b5e6709c742f922657a1540c8c85a8c33809fb1941686e163d25ad188e8f5f309ca013bedd16e0a

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
297KB

MD5
9bd20ce434e07be95b742d6c0f9c5a34

SHA1
0832f4bc231ad2d52a48bb21f54327dbe5751616

SHA256
67b9eec1d1ace0828930656445dd8f0ce5c7a8cca39d956eca77b18ffaa9aff6

SHA512
b6e2c5cfcff70c9d4953b18b2b6e28247623f20710013e18ea132053b82198f873d06fe34a0e84036b2adbf76eadeda5873d5cd6b7f69492ec0e7aeba00fc140

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads