7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
Size

92KB
MD5

1efaf7d394300b993601f4633b3f080c
SHA1

51c03929c3ce59032da175ace193406b86507e51
SHA256

7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d
SHA512

76634929912ef409f7cd5bde5adb348e9a7d0b93108a635fdc5e0ea8986f55d368b06f40c4c2cddf4cf7711dda907655ebd8b9ddc35df269fdc259d480d1e85b
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/bat:6e7WpMaxeb0CYJ97lEYNR73e+eKZbat

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1534) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.DirectoryServices.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Xaml.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Xaml.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Json.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsFormsIntegration.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-private-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.VisualC.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Controls.Ribbon.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Primitives.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebProxy.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Xml.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.25 (x64).swidtag.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\FormatUnlock.mpeg2.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.X509Certificates.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Primitives.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Input.Manipulations.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemCore.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Input.Manipulations.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Writer.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationUI.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.DataSetExtensions.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsFormsIntegration.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsFormsIntegration.resources.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClientSideProviders.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorlib.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe

C:\Users\Admin\AppData\Local\Temp\7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe
"C:\Users\Admin\AppData\Local\Temp\7dfcbe32b1feda3114f4c4b68e3149ac01e3bb80a0bdd8ae0b22dde8219a305d.exe"
1⤵
- Drops file in Program Files directory
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
92KB

MD5
27c3a4116970137fb4aac41e069dbc6f

SHA1
0ca99226b5d552681f1f19b0161693ce61201537

SHA256
48c0f279bcfa4b9d2f51e0f765d004c73669f542a5df702a8b8d79e356e3102e

SHA512
a66c1d7136aa08f134f53ad1a5ea17241d94b332c2a96408ce758ffe6c2d5ca54535e436c52c462f43542e8550fa19379ad75f7beb8cc325d4ed1c46b91fcc66

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
92KB

MD5
f663da80775155d9a7ecc560570e66b6

SHA1
716c6488368fb2e463822aa50d09ed81174f2896

SHA256
45dacbc8af4e932106b2310084f84853c5a828f1e7668322d2684695467541f3

SHA512
cffa3650c7242b96544a2f2a7d92662cf31e2d489e67739ac7bb9392062063eebe64f0aeecc1c991c4e1cd5791cf966929bbc082763ce83362a2ea560004a641

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads