fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c

General

Target

fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
Size

76KB
MD5

8572562bf1d96413240864457aedd224
SHA1

645ca7acb1ac7b3e5c1aa1c59ded92535f0b25dc
SHA256

fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c
SHA512

04ca8b8b3030f280b71dba16fcdb3bed670cacb608b7bb5dd7ff155104c9a85b6b05f81eefdba110936fb64624620f0a7eb69e03eefb36ade5d078bb73c3fb36
SSDEEP

768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJC:W7Z9pApQESOHepOHe8G+6E65TGA3vK

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hi.pak.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe

C:\Users\Admin\AppData\Local\Temp\fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe
"C:\Users\Admin\AppData\Local\Temp\fe838e835274b11a5ddb9648446e83c2a2760f592f43e23b8c6a569d89be616c.exe"
1⤵
- Drops file in Program Files directory
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4316,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
76KB

MD5
5fd7ac38ea56c977ace737cabf529917

SHA1
c49b7d99db435ce7cb9928c26c77a40fe539cc78

SHA256
af893a03868f91b4a56c0acae524af88c0d46a87e0d211c0483a946ec49a2089

SHA512
b03511deca48f267293ced30e9a9da8562670b14039b89133e14e371b4052733f1523e1756863da703413b1445b44483364de7132ed710f5fde19d35c2d65de0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
189KB

MD5
5394449b23b91b6963770c1cc9baf844

SHA1
9fa6ce75eb6bf39bb2c37c58dce3fba64cae4d1c

SHA256
bd41cce6a61bd526c1bf7a2c5bd70d58ae0b5b7a2dc91978d0fd9569d5569e70

SHA512
39144cf00961e20836463b0fa4128afbf48d0431c51c7daf0d493fb69df4db7804acfb35ba2ba9e72af829e87b94ddf157400944b32f553abb96d3d5f6e4b685

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads