eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
Size 74KB
Sample240530-e8ttsseh2v
SHA256 eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36
MD5 2cb0493debfe2913417682dcedb18e77
SHA1 046d68ffa7596e2f3ab00c221873aa8e3616ff49
SHA512 c8e55aa200e4d856ca145da5f6e637e3d68a0ec3e8e835eff058eda3d4c988bbf37af28c21c5a8209468fcb4f9871ae26147ab0be52056456d41db9d1eae779f
SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhe:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs3
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Design.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.Client.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationFramework.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-locale-l1-1-0.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.DataContractSerialization.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Input.Manipulations.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.IO.Packaging.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationUI.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClientSideProviders.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Aero.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.Primitives.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationCore.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Parallel.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsFormsIntegration.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\WindowsBase.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.Unsafe.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\hostfxr.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Xaml.resources.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Printing.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe

C:\Users\Admin\AppData\Local\Temp\eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe
"C:\Users\Admin\AppData\Local\Temp\eb0c828ff1cbbbcf9cf5cea141a358afa7a55c1856d81891feafdca198227b36.exe"
1⤵
- Drops file in Program Files directory
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 75KB
SHA256 6122872394d3e14d47bebb23e0bcb2cfde90c6c49407430bb055f45a4025f2ca
MD5 e75523cb9f06715f7b4300022356e62c
SHA1 8db8bd6bf6cb670619d7632c00a88952604c31e6
SHA512 b884b3ef9eddfec50f584f9911eaeb70b1404de13fb7d140a51f804d672c8087ab1e420b73b51c08efb7bce7ae07219865a0cc336bb59ae18c963deab5535fa9
SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhh:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 74KB
SHA256 89b9f057675beca20d3140026cd2c09db93f6bdf6d512266d588e4875b312aa8
MD5 2ea29c29b18db20b699481b912d567ca
SHA1 e9555b44c0295d198a32ff4a41a960ca416b0ff3
SHA512 7ba1f550811362c176fb9b7fc02cb2bf26715d9bf3925876dcd6769becb3aa1e3f3f5260288c8a77ed169ed929786d7655a93bdba8c41f82dd5fd55e87e8145d
SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhl:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads