f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
Size

91KB
MD5

6749cc37fd79f99b7a7bfd17abf14a15
SHA1

e104a46c8cedb2e0d5d3bbf9fc4fbbc7cfae7586
SHA256

f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1
SHA512

1032830b2ffbd4972be4e952223b9eee54cf1d3e71f8e19f1860d543f1bcf4ecdccaabca49238a50c065a51fdc92a25e80f50c3ab9190e14ce938ca3f78a6220
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaqvD:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXH

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1593) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\PresentationFramework.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\WindowsFormsIntegration.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlSerializer.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationClientSideProviders.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationProvider.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsBase.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.Primitives.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.ServicePoint.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Xaml.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Sockets.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Expressions.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.Vectors.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationTypes.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.Unsafe.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationCore.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ReachFramework.resources.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TextWriterTraceListener.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Debug.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe

C:\Users\Admin\AppData\Local\Temp\f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe
"C:\Users\Admin\AppData\Local\Temp\f6e11a932fc5670b29ce252b5f73402f806d811dae989f9d96f46b78aae0bab1.exe"
1⤵
- Drops file in Program Files directory
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
91KB

MD5
9b50c00344f5b8af18600d584be47144

SHA1
77e018f0b123d265a51afd867fdebd6f0a22b6d1

SHA256
bfa07f334b0fc2b26ab2d4c93b2f1fb73792ded283666cddcb44796dd43995b7

SHA512
b17384dd534a3e6f9fd8fc5c8e77e343e31cf40c6953b6e5d0f6fc70af4ce2a2aecb640c630802bc89619ac941c3f4f9d9f05829dab698fb3bb3abe941b02db8

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
91KB

MD5
ff7faf8100f2461a8f6b4ba25da9e6bc

SHA1
10007b7166f7b944956d37955972ef03224038b7

SHA256
18bc0e49854791c6589adb1b1284401d70b929396d5b407e15a544c4167e3b34

SHA512
de4e401ff3be69e586660dbe248e5e5993f702b1d32afbeb27fce059cd642b0c73010bcecf762e8a4bcf927f4b25edaa8513b412b932171a8ac6bbd714e0f31f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads