7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
Size

89KB
MD5

22c0ad6d5a3ab596db1e96ef8760fe99
SHA1

069b9a9df2fad827c5ecca4508254827737c45cd
SHA256

7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9
SHA512

609329b9bd1f954442f260f2dec7be59ae66415a4b3da033b76eedbc981b78df16fc1cd75e21199425251a0627789b37a8c991cb4cbc198c378acb2dda54e2fd
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPU:6DWpwE7oL2e+efZwZ08i82

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1832) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PenImc_cor3.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationCore.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.Design.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Brotli.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.Unsafe.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Parallel.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Primitives.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClientSideProviders.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsBase.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe

C:\Users\Admin\AppData\Local\Temp\7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
"C:\Users\Admin\AppData\Local\Temp\7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe"
1⤵
- Drops file in Program Files directory
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
90KB

MD5
55ae13e5c6226c1bcfc5169686340e9f

SHA1
d9cc759d9be6f93f00045f9061cc973f828c3b26

SHA256
3d98b7696e9a53ec1be5083d0313fb8ead41d205fd679c86cac2d5d41acf0930

SHA512
47b341fda8612c587009c2488e9a555d16d7a9217cdfebfc5c6e0d7d324aa3deb877608ea3ffa2e603495f146de481abb9682c0b0abcaa20e5ce2e90594ac903

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
89KB

MD5
226b3adf267efaec0e8650dd4f865734

SHA1
2f6aefb04976e159b56ea3f6c0b5d01f76191510

SHA256
c7f9ce55c13e1a508e927a97e10928bb0b5ccde0cb6a80b838951a936790b0d7

SHA512
ed8979bc7d04511173c3bac3099b14642f9285ec2f82689710b14d67f0c6f78ff7cdbede41fafabe7f0dadfec2c7942bf02cd1bfcf2b138513c07ae2674d831e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads