5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde

General

Target

5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
Size

77KB
MD5

68736609db90955074309ce986c4ce97
SHA1

e2243f68da73b19edf16d873106657f8e8cf182f
SHA256

5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde
SHA512

2bf94a79755398c66b69c0c1cdb6d9efbdc8332dd3eb31a6e6ab3cc7acd8028f7e12a3a9d4e63486009fb3448a69a429ae65780b6b245cf457762f79ceff3a57
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tGw2wxYUg+:6e7WpP9oVLQthbYY9oVLQthbUrt7tGwh

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.ReaderWriter.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsFormsIntegration.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Process.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClient.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Primitives.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationFramework.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Encoding.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Luna.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsFormsIntegration.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationTypes.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Memory.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.deps.json.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.Lightweight.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Transactions.Local.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationTypes.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Primitives.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Expressions.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Primitives.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore_amd64_amd64_8.0.23.53103.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l2-1-0.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationProvider.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\coreclr.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Xml.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationUI.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsFormsIntegration.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsFormsIntegration.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClient.resources.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.25\hostfxr.dll.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe

C:\Users\Admin\AppData\Local\Temp\5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe
"C:\Users\Admin\AppData\Local\Temp\5bc8dfa4d62216c101021ee714633862e4026ef139d734cc442c6fd9cda6bdde.exe"
1⤵
- Drops file in Program Files directory
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
77KB

MD5
84542e9e783a6b72438bba29e841ad71

SHA1
566781dc69eccebb6c6ae9c020ad787440cc2a31

SHA256
201dd97b936246d333cf38d0327d00314e440c05dc7e0bfcf03ec95cd796f5cf

SHA512
1d0736f88d404a3605cab05f37294af94ef25eeb8586cca7fc6532f26947f9fcf0d1bfb450d457082c53be5c998e683d6d82a47516f7b3a135fdc0abf7a055a4

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
77KB

MD5
0303334b5a5e1b757ff25fb859b25473

SHA1
76b0ca5ec28d81c5127a097f56ce6e6982e32c59

SHA256
83282756fc46f09331064627e8d81cd8c226327c1dc2fd46f79d1c009c57b443

SHA512
0866de581512c318663dbf1f64febdd4b134b68c8332f634a706bd453e50bb592f63c7fd3fa158ee270ca070b4f11dd1ddec8e73fe63bd7434ae85bf455996a5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads