5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
Size 92KB
Sample240602-2j8b8aaf94
SHA256 5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1
MD5 016b2f05912f2b660b36afbc7c9bb399
SHA1 d2436db3d3ad5a6eeb12bad96d20c8953127e0b1
SHA512 addd70f1c7e38f802b652359025c141a7dde8c5f15dec65b5d06cae3cd560009def784246806760c3339786f542d4498c89f04baacf392c0d2a485b7ee75382c
SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNy:6rWpcOPxPke+e3fFpsJOfFpsJbgEI
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1447) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationClientSideProviders.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClient.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.AccessControl.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Serialization.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\WindowsBase.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Cng.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Design.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Xaml.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClient.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClientSideProviders.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Queryable.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsFormsIntegration.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationCore.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationFramework.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsFormsIntegration.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Design.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Json.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.DataSetExtensions.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClientSideProviders.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ReachFramework.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Channels.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Primitives.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp	5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe

C:\Users\Admin\AppData\Local\Temp\5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe
"C:\Users\Admin\AppData\Local\Temp\5eb34a07d7c010ca2276d06b9adb91788461d7954ce629dae94d6e9c009b59e1.exe"
1⤵
- Drops file in Program Files directory
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 93KB
SHA256 d2c92ffecdd927c0ab9c9214b3667f407c5f953ba87278146bf6a6cf3f18b591
MD5 37d589dc11e582994f607457ba740646
SHA1 1a28583274a1117a12554e1bf8f40619f97c4242
SHA512 65b00b095af77c53f3cef514004fe57dd8ea5ff45c21c1d57b80d489e2f1da021f78fa3e30139893a6fd21495de283b9f4606711092d873169f626cda384cf78
SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNT:6rWpcOPxPke+e3fFpsJOfFpsJbgEl
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 92KB
SHA256 1c1aba6268d4bec4e2fc66520d8c6412b32866869891e566fa2b7622082ca9b9
MD5 e42256a0f1a15ae865ac1b84fe17858d
SHA1 e53a3e73627c51362d7ff4bca7ebf3f88d281107
SHA512 2677241eb56d21c6598b7af5058d45ed1a4f5e5dbfaf7d660a3f2935079199860809e36b3ccb865337aaa16358d5603be0c78e1c446d19871a4df6bf4b055b0d
SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNo:6rWpcOPxPke+e3fFpsJOfFpsJbgEi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads