515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e

Analysis

max time kernel
153s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
Size 128KB
Sample240601-1cpe4afd9v
SHA256 515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e
MD5 0bab7605c919e704a267e5ad8a304f3c
SHA1 49c86e0261403c2faf2d704fb1426ff628496efa
SHA512 7bd8b1d0c4e053d31a9cd7ec042184d34f742af874bff1aa1238423ae98c10d3835c48c52f52cddf850ad603b6f956ff57fdf01abb1cc7b36e46d1fe2295b681
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzf:RqlIyFESWu0SWuGSwx8
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Windows.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Xaml.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encodings.Web.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorlib.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.JavaScript.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Serialization.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsBase.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.AccessControl.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.deps.json.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Primitives.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\ConvertInitialize.cab.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Xaml.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Primitives.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.Primitives.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Extensions.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\AddImport.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Expressions.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Windows.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Dynamic.Runtime.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationUI.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Input.Manipulations.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsFormsIntegration.resources.dll.tmp	515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe

C:\Users\Admin\AppData\Local\Temp\515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe
"C:\Users\Admin\AppData\Local\Temp\515c8ed64ed589e75481e52070ec49cdb867cfe2605bc26aadddde9a25bbfd0e.exe"
1⤵
- Drops file in Program Files directory
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 128KB
SHA256 cb582bc2392a7c39616e88aac3f0d6587daf736a58e2af1686b276249ac052b9
MD5 4d56b26b61c894a22ee7f403aa7d82ba
SHA1 30e432334ddf97f5e4f57d50db653604af98f2ad
SHA512 ed94c49688284f24fa2691fa7bc74fd1f5a56bb433b57309861df59c8d750a4a1bda7fea708ca83c2b4a885f17c8ab5194d770466cb261141ec5a8e031c0dcb2
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzS:RqlIyFESWu0SWuGSwxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 128KB
SHA256 e120355fbffafee8bcc00f2af63690d530fe3fe0fa49a2a7b1d5cd348548ae9f
MD5 8c0afc922afeecaa6e3d0cc6bc250cfa
SHA1 031849498960e43e7872ac688eb6f58d8777d548
SHA512 c1c1ec626fdb7dadaadc702dcc14b4f0d008c7c3cc4ec147790047e5d21b21a9ecb006ba25c7109504fc697a002b630da41832f3c21926725020a5f422512bfb
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzt:RqlIyFESWu0SWuGSwxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads