1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652

General

Target

1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
Size

78KB
MD5

1936b94cd9eaf8fd8c16c1df20618e70
SHA1

bf4ae63346e96e8ed33298feb1a3e248c89d39a3
SHA256

1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652
SHA512

a4e6cde1965c14111a627dca0fd6c6d6c920a23f3203b5824366560e7257fb82e34b1efc8c857606bbe9241615fba3b2d477f27e5b5d4d69e5e6584a5fe66eec
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65TGApuwu39i4L:69WpQEJAp3k

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1301) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.Editors.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationFramework.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\DismountConvertTo.aifc.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\dbgshim.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Uri.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\ConfirmPop.vsdm.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Xaml.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.UnmanagedMemoryStream.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationUI.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\ReachFramework.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClientSideProviders.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Input.Manipulations.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationUI.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.Client.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-utility-l1-1-0.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationCore.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Input.Manipulations.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.TypeConverter.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Input.Manipulations.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\ConvertDebug.ico.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationProvider.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationTypes.resources.dll.tmp	1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe

C:\Users\Admin\AppData\Local\Temp\1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe
"C:\Users\Admin\AppData\Local\Temp\1c56015eae9c46bec760473c11a5ca4e2feb3cd8986cf10f73e6c8405710a652.exe"
1⤵
- Drops file in Program Files directory
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
79KB

MD5
7f031ba6ba076f63eaf7332701907880

SHA1
f1af85b5bb43d3a7f4f7c13e897880f43ad5e0a7

SHA256
0464e0c1873476301ff7489d42f9894f3375a1c1bdc7efdeff447e369d3b48e1

SHA512
9bc6bfaea3febe02981a4d63434511f056471f9c31daae93ac361b84ec1599f8903ff0c12b6f1e08537440418ae6a20967a5f10274469579da4e59307e489d95

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
78KB

MD5
3265a70a92a31714eb4c340f09279b32

SHA1
ee45d8f0949e6a7c41c454b0b2a985cb97f0f16f

SHA256
0cc1c5d975a4e609c14038ea07d63bfd351047d1191095a7187a18618d0c8b66

SHA512
d9b2af08a4a56830f57378d8cc20bf7cd0d8a16a4dc41cae85eda8fc58de2b52a38ec5f9c07d2e15759c81aba11b15c07ce80dd3555944e1ce3292c5011604c0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads