97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f

General

Target

97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
Size

82KB
MD5

1f9dbcbed619e45b837237bd85884dc0
SHA1

59e5e403da7468078077acc91abc2e12f2e0ff15
SHA256

97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f
SHA512

50f64f3c624e380503216436e20093ee4a5dcf59bc77678eb56f56e443985894d902a0661f526e8880431c5428e250fcd5fe14c470f2e4b3fd6b19bf6d83da11
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhI:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsB

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1559) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.Primitives.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsFormsIntegration.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\ReachFramework.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationCore.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsBase.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\ExpandInstall.aiff.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClientSideProviders.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Ping.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationProvider.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.CoreLib.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\WindowsBase.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Sockets.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebProxy.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationFramework.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XPath.XDocument.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Permissions.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Extensions.dll.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe

C:\Users\Admin\AppData\Local\Temp\97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe
"C:\Users\Admin\AppData\Local\Temp\97337c2a497b6ce20207c81887743f90c6532524a2dc3b796d9f1ca2d3b0229f.exe"
1⤵
- Drops file in Program Files directory
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
83KB

MD5
41dfd568dc783862a7f1e433d226f358

SHA1
02187a6db23a828c517effba6e32d47a5cdb1d35

SHA256
fa6169c3d903b963edb454d1d2990223e6636d01fae68da0e2aed5b5f0bbf62a

SHA512
6fbd4f75fa847f2df2a3344e23327b4037769a94c0f0d7ac83583bbd65111ee5636770cabe2abfec093bdc6066d71c15ebaec9923351b2db57eafc2a906cf855

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
82KB

MD5
3cc99e74765eac9631a90845a6aa7129

SHA1
f98c8aa02d9c304ecb35d00f3f6efd613b30f017

SHA256
2563862e5faa79b996d78802f9a1025a8131a73d9d9c24b8a5570fc6961bbd17

SHA512
85b261b262765f6da218992bf87b7c9f8bae134ea337abd446d5971f3557d4172b148746f74024eef8c0acf4c3411087f0faabe8f1e7ee43eef5595b629fabe4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads