4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab

General

Target

4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
Size

82KB
MD5

259fbb15ffeb9f75c0f7dc77754159ef
SHA1

9260ffca8aed3300663b1309726d775602c312e0
SHA256

4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab
SHA512

228ee58ac6e90fefa2941eac2d9cb687cc5c0d9fe2594ac50870df3699e9f3d14b25ee432f400ce55163624619da2c9f07d9f9e6b06ca094e880dbaf752a9fe9
SSDEEP

768:W7Blp9pARFbhQSox//l5l85nd5nsWbWTFTJHJ/vN9uA9DM9uA8:W7Z9pApQUNdNBKZJHJ/vp

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Presentation.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.CSharp.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.AccessControl.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.TypeConverter.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Diagnostics.EventLog.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Input.Manipulations.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\UIAutomationProvider.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\PresentationCore.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore_amd64_amd64_8.0.23.53103.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationTypes.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Annotations.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationCore.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationTypes.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Configuration.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-profile-l1-1-0.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationCore.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Algorithms.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationClientSideProviders.resources.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.ServicePoint.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Aero.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Sockets.dll.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe

C:\Users\Admin\AppData\Local\Temp\4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe
"C:\Users\Admin\AppData\Local\Temp\4693062890872e1ecf5b82b9ddc0404bc912d5f74d0aad49058b2bf4435c0bab.exe"
1⤵
- Drops file in Program Files directory
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
82KB

MD5
5f4debe701facdbe77938832ef5a6219

SHA1
2c7b0f330deccc28ca6760d5ef39ad772db81779

SHA256
44e825e2d90d482bf50659744299560dc477ef87b8c9bf2f56823750386f7d32

SHA512
1f17077839d798b2edcbf60a4a25b773d95e1c81d9507e20f6cb1a89f6b544db4ee062c984c60b3df67916b3126d63529169ae19d63be0d7e7ff6e097440a038

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
82KB

MD5
53d75738b9339244180986dd9c6d9c8f

SHA1
25297da05be89845bbdf435d8a1fd950c5405878

SHA256
e1e64caa2e989d13926cea47b62f1164e41e772d0dd33c2b665fda32f54efac8

SHA512
0d84317a98645b281fd181e18daae23cb5e9d5b4c8e5cdb8a6afedfe5533d5b6c2f1b1f9b2ca66439d113abf779ab009d6dca0f0c48bf9c4f169432d7656d7ac

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads