7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
Size 89KB
Sample240611-3x67rawdrq
SHA256 7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9
MD5 22c0ad6d5a3ab596db1e96ef8760fe99
SHA1 069b9a9df2fad827c5ecca4508254827737c45cd
SHA512 609329b9bd1f954442f260f2dec7be59ae66415a4b3da033b76eedbc981b78df16fc1cd75e21199425251a0627789b37a8c991cb4cbc198c378acb2dda54e2fd
SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPU:6DWpwE7oL2e+efZwZ08i82
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1832) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.HttpUtility.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PenImc_cor3.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationCore.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Windows.Forms.Design.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Brotli.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.Unsafe.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-timezone-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Parallel.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Primitives.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Extensions.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClientSideProviders.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\UIAutomationProvider.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsBase.resources.dll.tmp	7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe

C:\Users\Admin\AppData\Local\Temp\7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe
"C:\Users\Admin\AppData\Local\Temp\7c11279454fa17046b9c99c4403e4105f310157a2c893b51e898215a4f01eab9.exe"
1⤵
- Drops file in Program Files directory
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 90KB
SHA256 3d98b7696e9a53ec1be5083d0313fb8ead41d205fd679c86cac2d5d41acf0930
MD5 55ae13e5c6226c1bcfc5169686340e9f
SHA1 d9cc759d9be6f93f00045f9061cc973f828c3b26
SHA512 47b341fda8612c587009c2488e9a555d16d7a9217cdfebfc5c6e0d7d324aa3deb877608ea3ffa2e603495f146de481abb9682c0b0abcaa20e5ce2e90594ac903
SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPe:6DWpwE7oL2e+efZwZ08i8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 89KB
SHA256 c7f9ce55c13e1a508e927a97e10928bb0b5ccde0cb6a80b838951a936790b0d7
MD5 226b3adf267efaec0e8650dd4f865734
SHA1 2f6aefb04976e159b56ea3f6c0b5d01f76191510
SHA512 ed8979bc7d04511173c3bac3099b14642f9285ec2f82689710b14d67f0c6f78ff7cdbede41fafabe7f0dadfec2c7942bf02cd1bfcf2b138513c07ae2674d831e
SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPr:6DWpwE7oL2e+efZwZ08i8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads