0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad

General

Target

0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
Size

86KB
MD5

32dda3397eb284ad1a33ed8dec9dcb1f
SHA1

726f02fd6a803918ca8464413bf2f387c40676f5
SHA256

0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad
SHA512

0c7103c58747ac271aac6f04906e4585d63f84cbdee3e076aa62afea693b6cff65cdd28343a67aa120ab08ba3d16a8933e40cdb1f4e2e2b71d38f3a7e2a5a15b
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/2vn:6e7WpMaxeb0CYJ97lEYNR73e+eKZ6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1398) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClientSideProviders.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Classic.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemCore.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationFramework.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Security.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.Vectors.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationProvider.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Immutable.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Design.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.SystemEvents.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.Design.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationTypes.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.CodePages.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Writer.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\ClearConvert.ttf.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Design.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Configuration.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Primitives.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationCore.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.25 (x64).swidtag.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.DataContractSerialization.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Configuration.ConfigurationManager.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Primitives.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.DirectoryServices.dll.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe

C:\Users\Admin\AppData\Local\Temp\0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe
"C:\Users\Admin\AppData\Local\Temp\0d4b61396b5417ba81ca160d3a18888faaa19f4d1c02af19ddb56e30281027ad.exe"
1⤵
- Drops file in Program Files directory
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
87KB

MD5
6713a6774063a4c9f2e9aad2ecc73147

SHA1
d8581ed8230ba12fbb26332d66d1156989fe6e85

SHA256
afd53de02639cddddd494d832948a0bce3e3b62846c6f8c5a865bb5c82689fc4

SHA512
c97b4c95fdc317be941ac391bfbe1a89daa8f6d01bb9d7d6a33140479abe1b0b18471e4f51e762dfa5232cfcc981dce7ae329ed20a79ebb8b203e449f1319dd2

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
86KB

MD5
ffc8e064a9b6f43171603136565ef70c

SHA1
e66ac263ebb62ecc61a2150f16c2ea08aad1d9ec

SHA256
ac616bf7a3179bf98f70975098acae24cee118ef664e1d59c99896697d728668

SHA512
300daaeb6eaa3dae562a0765f07131d4961f68a16252787d8c4a9b7f695fbc43b7f95fd2f1b4c7a8ef4fad1b3456c429b3168f65957b406a4c8ff8521e92d1b7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads