498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d

General

Target

498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
Size

82KB
MD5

191ef9eac97b4f0b74745dbb04ff6814
SHA1

54e529d5da42df7f11712d321242df9f69b4f26c
SHA256

498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d
SHA512

de34ac232f5f65daa4484c862429406ac4ea407b2046b39e1b5a102bbb5f8d32680108aace296f5c60fd836955fa503c694d6119e62de7eb263aab667b3412ec
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65TGAzEWzVNOx0ypIzIu73mYdE9aC3s9XL7EWzVNOK:69WpQEJAzEWzVNOx0ypIzIu73mYdE9di

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1345) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\hostpolicy.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Classic.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Controls.Ribbon.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Forms.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Input.Manipulations.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationUI.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Design.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.Primitives.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClientSideProviders.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Primitives.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TraceSource.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationUI.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-process-l1-1-0.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Xaml.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationTypes.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsFormsIntegration.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Xaml.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Design.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationCore.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Input.Manipulations.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsBase.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.ProtectedData.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe

C:\Users\Admin\AppData\Local\Temp\498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe
"C:\Users\Admin\AppData\Local\Temp\498ddfad28fd75bdc3d1922c703affaed91ecd0e794ec71dc3ea14c47c22276d.exe"
1⤵
- Drops file in Program Files directory
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
82KB

MD5
6b3f7484ff73a92879f66cc33c67920a

SHA1
23a8d0f378e33302b6c46eee0ee2ff50b661fabb

SHA256
4e0af1775a0daa0a4757f06070bd4bf8c0c7b1b1b3781c35a781b7d06b47a762

SHA512
b6d0ab784dc1c1904ab01dc4d95d6b2509396a5303e093213fbe91224ece964b67a781b3ec9d90f94c3bf3e98c5d25c41352efc50fb5b61f49d34c79179e79d2

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
82KB

MD5
10495514b5aa8bb7b177030b91cf0367

SHA1
36404c81d1ba0ca7f7b0fdb76892f8631eb3522b

SHA256
6160160f4fdffbaa3d95535659aea458252b810e938c2fd37a1d0f0cd7465427

SHA512
be65f85217066338f1bf46f68a1e68e991ef77598775e50e1fc1d3824f384b53af3c459a0eebfaf8685cd207b1f63d1fcfb9f0aa38188a470e923f51a6a958c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads