ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
Size

98KB
MD5

2fa54dbbb4dd69726b041d96ce92922a
SHA1

9f76eb5ffa39b6e958e84e2bff65f9b318eff562
SHA256

ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034
SHA512

12b30170fe5f31e5d05f4fd32dd110c6d31dd83f94b47d2905b2ac3d8b5c88f42573e3ae053bed56aeb547a01d11d9e05f34724de1aa292e07a861bfa742e70c
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzS:RqlIyFESWu0SWuGSW

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (556) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorlib.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TextWriterTraceListener.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l1-2-0.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Uri.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\ClearConvertTo.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.Annotations.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Primitives.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe

C:\Users\Admin\AppData\Local\Temp\ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe
"C:\Users\Admin\AppData\Local\Temp\ac47efa5775d1cab7edfdb5f8c3a8b0e88964cdba9ceba5d19ae9ea0a5f7e034.exe"
1⤵
- Drops file in Program Files directory
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
98KB

MD5
198f69eba0f71ab85d66dc34592b4e41

SHA1
ad10bb2178a065427d531c023f29a9f2b985651d

SHA256
cfb40055c8d18bfb406118908e2aabfe1b3ff3d63e3be86f3c36035ef663cfbe

SHA512
bf42cdb31c01d451701b7a19910b8a4aafd2078dd395ee1555a77955778d8b5a3f7ac707411e8d0da17593f64557ecaf2d3fea02deb1d88c2c3803328e7de889

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
98KB

MD5
02ef2a8a4851416c847a6e9b2077b054

SHA1
c5e1b6c1274a8473f966f15379f3e3e30aae97fa

SHA256
0f92e7cb4da69fad311290434e3687e84e28b97fdb4f668c55bf162ceb883113

SHA512
714d4da6fc652407fc574be4351eececfa185377026d0d15c34da5eda61f3c67c8a3fb3cb542e49767196d25eec40b99ae6d97c3abd702234a0499137cb14ae8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads