Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe
Resource
win10v2004-20240226-en
General
-
Target
5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe
-
Size
91KB
-
MD5
741e1e6fb41e551d97866d7efd5207df
-
SHA1
ac06c7869562f7b9bebf0858a1465f1f3fb41149
-
SHA256
5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f
-
SHA512
4b2620ed8b1ebf1f9840e0de2569d4322978ccaaa7fc3b27f923365f41ce45e65c12594c155b54220885ab39551f5215c7102fc025bbf79c91cb89c202ed8e91
-
SSDEEP
1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNc:6rWpcOPxPke+e3fFpsJOfFpsJbgEO
Malware Config
Signatures
-
Renames multiple (1286) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Controls.Ribbon.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.Design.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationClientSideProviders.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\msquic.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationClientSideProviders.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationUI.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsBase.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClientSideProviders.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\wpfgfx_cor3.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClientSideProviders.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebClient.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.Windows.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Xaml.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationClient.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Xaml.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.XDocument.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.Design.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsBase.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsFormsIntegration.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationClient.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Http.Json.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.DataAnnotations.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-handle-l1-1-0.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\ExitRead.csv.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tools.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll.tmp 5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe"C:\Users\Admin\AppData\Local\Temp\5e4ab722fe710f6704c7557ed94cebb5a87b27caa18d4f3baf336a8846444c1f.exe"1⤵
- Drops file in Program Files directory
PID:1900
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:2400
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5b3e4d87f6cbd1c4807e51bf654f991ae
SHA126ce0cf8eeabbbead853be7bfa9bf673f5b29ad9
SHA25626ed56d99ba87cacb583259e05823f1f00698c36d9818db8b698d1cdcf3500bd
SHA5125175385b08f181a5a190f1e9f31e0fe5de7a330a4fb42e2c3d2df98a66c3bb679ac7b0c9686edd941630155a429999daa3c8bd6dc57e34c8618a902077179d01
-
Filesize
91KB
MD5d5d8c5b4bf0070158ddbb15ad5cf4b5a
SHA16e06d20036e607cf55f16516d89272b4b4590aaa
SHA2566c04c42156742911e07be608cd96f72f0c24ecdc0b7e37eb67175a40851d6f86
SHA51249a334177c3bd46dd418ca06f5aae1a3a4feaeb2ad20902b646aaddf68a2cb27149e8c1fef6b0256ab38556d9c81862eb1d3de6f46db1560e5928cbb246c3322