53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
Size 42KB
Sample240601-1gbd2agc98
SHA256 53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e
MD5 859a6a7453d95939097e404f9324966b
SHA1 46f238a77f28f397f606cf6b27ed1c06bd5e61a8
SHA512 5d6a9ceb45ed8323008d3ec38c24453e042914c2c2700403b79afa66e253b3d4d051bf612314097b5e77774c9386404380413b33a04bb2c125f77e52a9b16ce8
SSDEEP 384:yBs7Br5xjL8AgA71FbhvgYJfPg7JDYJfPg7JMm7G:/7BlpQpARFbhIYJIJDYJIJu
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1972) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationUI.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Design.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.AeroLite.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsFormsIntegration.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsFormsIntegration.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Cryptography.Xml.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore_amd64_amd64_8.0.23.53103.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.Win32.Registry.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Process.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Formatters.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceModel.Web.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsBase.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationCore.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\ReachFramework.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClient.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationFramework.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Security.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.Common.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationTypes.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.Primitives.resources.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe

C:\Users\Admin\AppData\Local\Temp\53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe
"C:\Users\Admin\AppData\Local\Temp\53e2138d28d142158d20982a558a18fd03dbd0c1620ed2324c4db694050a7b9e.exe"
1⤵
- Drops file in Program Files directory
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 43KB
SHA256 430eba7793da6fe8fd06620fe1f8a69662dfc599b897db4b12ed32a777ff3653
MD5 dac94574f1a31ede76e814b87bc1a33c
SHA1 6b5fd6fe9f15f031c031916ed69ffd6ad6125a93
SHA512 8450184cdb83f1f3f8569910dab87acfad72a8751d03583c6d39b2e566485618d920e7fd9760e912de0f2078370a50e662a2378278a999f162e5ef01821cae1a
SSDEEP 384:yBs7Br5xjL8AgA71FbhvgYJfPg7JDYJfPg7JMm7J:/7BlpQpARFbhIYJIJDYJIJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 42KB
SHA256 d3aaddc85a92e7864c3f9aa55b8c108b77a853e72e66659be9b1629fb1841d0c
MD5 dedd13b541fec08ab9c05fba74a38ea3
SHA1 8b66410b9ac2b7a376c40e12579f78b824556d3b
SHA512 a6547546233ca7c681be8af408a849fbdc3127e44ad33fc89b989ee5a07a392b47fbad1b2021f28bd600f0a3d675fb22625250addf0d380fbfb333a9639ef116
SSDEEP 384:yBs7Br5xjL8AgA71FbhvgYJfPg7JDYJfPg7JMm7E:/7BlpQpARFbhIYJIJDYJIJc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4060-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4060-652-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads