a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6

General

Target

a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
Size

46KB
MD5

332c3622deb4bd305aba431dcc19742d
SHA1

c2842342fa3d2592930fe60063615ae6c68b3e14
SHA256

a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6
SHA512

09237fe683feac622b35c14f40e11f10c7a4ea457995e64a8641fa8c58ff47ee6db2bfcf3e9d8bf9096cff4de8da8101f081c09648aa13c5cc4036689fded1d4
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1Msv:W7ZNLpApCZrt8PWGoPWGs

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1487) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Configuration.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsFormsIntegration.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Design.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.AccessControl.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.ThreadPool.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.DataSetExtensions.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Json.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsBase.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\ReachFramework.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\coreclr.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Controls.Ribbon.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore_amd64_amd64_8.0.23.53103.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-stdio-l1-1-0.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Uri.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Intrinsics.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemData.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-convert-l1-1-0.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.Extensions.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationCore.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClient.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\ReachFramework.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationUI.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.Design.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tools.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationTypes.resources.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.tmp	a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe

C:\Users\Admin\AppData\Local\Temp\a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe
"C:\Users\Admin\AppData\Local\Temp\a2bf9ce24d6c99e9933ba60caf186df4ff34bc0f53acc58cb813f4a81e2484a6.exe"
1⤵
- Drops file in Program Files directory
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
46KB

MD5
04c9c0fa7ce87c112934f32d24726589

SHA1
36b92d23ee4a4a23a836d4aefa2e9844a92ea8eb

SHA256
0b74b00bb3ab134943b8062c8f61271fda03aa44c881a3b2fc6793a71ed356aa

SHA512
374f45987dc40a251d1d30758aa4b0d30500776daa166a9fcea583c11ef7edd1fef563d4b2fd5e0a7d2894218b4e083a7f235beb180e8a5ea94555640ad50349

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
46KB

MD5
73dff7bac6e6ecab5abaa86d8627cf6f

SHA1
603b2172e6aa25944efab86bc49e0d30f9ea7782

SHA256
2cd5bee9068737ed6c8ab2a2a8d39e7ac9141920d4364891f2c2864e1ac297d0

SHA512
9605ae912b5f4865b8ac67c9b6aa3a359a5052a3d31ec3483be844e72c310fde468c3374d351874b71dd28068174f3787df309f6f6ca695308f4e670457b3def

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads