c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
Size 84KB
Sample240611-dcmvya1fqa
SHA256 c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8
MD5 7604517930c53662cc1ab2f74453ffca
SHA1 3c955db515942c7f52b2bdf3f8d4df7fc36480b6
SHA512 24aa2c2e487d13780ad001bbed5caeb2d13ba5155c937868a4cab0005ac19f0464011e306fac231f661bdf09a423d3949539183ae63a25e74cce8bd84a4a3fbb
SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRe1:W7ZDpApYbWj2WTWJe+e/qXnJZJm
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceModel.Web.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.IO.Packaging.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClientSideProviders.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\UIAutomationClient.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\ReachFramework.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-time-l1-1-0.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Primitives.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\ReachFramework.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationTypes.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Intrinsics.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Loader.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ValueTuple.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClient.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\InitializeSubmit.m4a.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-heap-l1-1-0.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Process.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Forms.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationFramework.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe

C:\Users\Admin\AppData\Local\Temp\c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe
"C:\Users\Admin\AppData\Local\Temp\c32a78008eea227e98bd2dd79a2e3a2a3506e933fcc5548b8f9c8b0eab44a2a8.exe"
1⤵
- Drops file in Program Files directory
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 84KB
SHA256 2ae47d457506a14808a5b830bceef0a98e486570948da05d5afc739ac388a3b8
MD5 40f4f7c77f447f27e3c44c2f2268a49c
SHA1 f01b577836a0588cf973ff9c0a8aff8b43db4cba
SHA512 91ae9f5650ce3db42a05132b5cc6c9e07f0ffcefea01f4af690c7f3a6090f99280a88558e2a1222efafa2a96d0475e355b47cff5864c464c6b2a894f9ef51325
SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRe2:W7ZDpApYbWj2WTWJe+e/qXnJZJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 84KB
SHA256 e661394ad78654c9033912b2b108740250609ea7d10588a044b857b447c9200c
MD5 597b954b23fd454072c47abb3fa78739
SHA1 c6bba4b9c975b3632c5e109c4be589c755f6afc4
SHA512 e6a987c2d2ba35dd9473b9c1b0090c09b5208b995eeaa0768a83a1beeb9fc3496430caaea7f4b4a378049483c0dec3703ccfa2783abef04bf07ebc7c8b7c2521
SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRen:W7ZDpApYbWj2WTWJe+e/qXnJZJs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads