ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
Size 74KB
Sample240530-fb4s6sfa5w
SHA256 ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36
MD5 2a6846f6f571d440477c6d82735b9af1
SHA1 7557923a346e511d669c586de8974d423a732b67
SHA512 128474ada4e269cce0b826c56f56b4f3d6532134d42fe1f93ab8194e87c58c41c1fbfbbff92093ea34489c280a40d730e041ce564dee097e4fcefd635407ed39
SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69cny:6e7WpP9oVLQthbYY9oVLQthbUrt7t5m6
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.Design.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationProvider.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationUI.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationFramework.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Extensions.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Xaml.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.Pkcs.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Immutable.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TraceSource.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Dataflow.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.NETCore.App.runtimeconfig.json.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationCore.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Overlapped.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationCore.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Mail.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationProvider.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClient.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlDocument.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Design.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationProvider.resources.dll.tmp	ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe

C:\Users\Admin\AppData\Local\Temp\ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe
"C:\Users\Admin\AppData\Local\Temp\ec881e1a04d91b8eda6654292e523de3c59d1ebb90e7b730a440d623a8eedf36.exe"
1⤵
- Drops file in Program Files directory
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 74KB
SHA256 3ba6796bbd1bc41d17f89195b0d9378baa3acf90ee25bb7982f5b8e6278fc488
MD5 d704c7ee80608e0941fe5292898b050c
SHA1 f28f85423da5a1930de78d29dbb3efb1fb8c41c7
SHA512 f6fbaad73e8bd92428f23d716e0506e7e9b334d3b5e989a073401a0618741ff3cc5767ed1697d073232673206524c659b5d5afed2389a4b98def1b88b2851d68
SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69cnP:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mX
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 74KB
SHA256 0a7612c19c975b8222f68e3f3b96c66f5b96e39caa62459fc6ee9e3358c747ce
MD5 9ccfbfd4ba6184410cd53fa24971ce05
SHA1 71299f147ecfe7fb2cee51fb0c9eb64bfac28d0e
SHA512 1b987c97ced6b5e8495292dc0adb13d1608598429d1587a3e06dfede8e128227da0bd1435514d1e2f147cc177dd33709dd77ed4fc9ab4245ece2985176ab7f39
SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69cnM:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads