3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979

Analysis

max time kernel
159s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
Size

85KB
MD5

2cd54d55d2afe1b370327d60cb56983f
SHA1

86a55ab349d3fe8cb97488fc681b4be78b94e006
SHA256

3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979
SHA512

60d0995663f8d725731c06fe39f764608db78d02ae1c41cfde89f48effd46d38993dcade3b9189d8a8f017ca5c64c8145ea4901067ee5ffacdc8796e4c84ddc7
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76Rbk:6e7WpP9oVLQthbYY9oVLQthbUvD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.TypeConverter.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.DataSetExtensions.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.ReaderWriter.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.Lightweight.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.Local.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.UnmanagedMemoryStream.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationCore.resources.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorrc.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\msquic.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Brotli.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.AeroLite.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationProvider.resources.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClient.resources.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe

C:\Users\Admin\AppData\Local\Temp\3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe
"C:\Users\Admin\AppData\Local\Temp\3a7d6b2b3e03df3680b7e1018996ab5b3df27391ee1647d1a7559e11179e1979.exe"
1⤵
- Drops file in Program Files directory
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
85KB

MD5
98adf626a2140877e3ed7cf8ea5fa889

SHA1
4607f49fd2934925fbc191a06caea74fd03d5d32

SHA256
fcbd6724a00cf2c5a8b091201015f11b5dcbd9bc14ff00297251bb80f5c74a5e

SHA512
9475a72a1028e0d98f1b94a6203efe8727dd39ad17d89a51998a17fdfa300d8d788defb91611784672f47098c4f3f7dd7639b071e03786f84e78329b45df1e3f

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
85KB

MD5
6b254a7bb1e9d0680d96d74072bc78bc

SHA1
ead9d0a57c3404857635a3ade238791aa7c5602f

SHA256
c631f176d03b42dd2faf306eb313ef8a6d33e7951587728b530a63015faa99c9

SHA512
2113ff817710b161e26dffbadf5eacc0fb8be8884dd28b2cd0b5c02ae1931b0535b7dc7a5baa85acc03a19586b69bbb0e15bb67bbf322c7c76c59ca924b6e3c6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads