a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08

Analysis

max time kernel
8s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
Size

101KB
MD5

3e45648e7e6abf7a4a846fce0f766997
SHA1

2142968cd2017a4ec26e5c8b532758471daf4b64
SHA256

a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08
SHA512

b08d5a1d2107b13beef5926b7a75d4b4a81ae6df654f489dc155f1cb825ec4caf1d212909c1280636257d66de4def497b62d621d95780372b2dc158f0a319c39
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7ftCHLnL+:RqKvb0CYJ973e+eKZOf7ftCG

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe

C:\Users\Admin\AppData\Local\Temp\a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe
"C:\Users\Admin\AppData\Local\Temp\a2fee0160560a5e67024d78795ccb6eebc595f39eb3a2a5de03f893f06957c08.exe"
1⤵
- Drops file in Program Files directory
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4316,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8
1⤵
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
101KB

MD5
e9bd39539ecdb59f7a31ba5c03761918

SHA1
5e2fcdb0e95434b14233048e43a176484a986a13

SHA256
689a7dbc91d8ca25e60e8fcd2fc9cfbb38b51fdf842081a11ce723af9521f93c

SHA512
130f0f097c5fb238bac1737234b67000b773f3710842cb25a0e0bc83d28c11076f0fd9b7800c6505b1301ef2320186870f0fa4866cdae226e2b9afca05a73f84

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
214KB

MD5
e1dde4ebd824b48ffa5f0b60c82346ab

SHA1
80b83de8b8a1d8827ed778751e9da083ee3198b8

SHA256
37457f131826113bb6c635bbc6119f1ef55ecf410f728872a01e7a9d944a5ce2

SHA512
abdf8bd1276d5f55096c6225b346b00a83e0cca98b33bd9d3fac553b27f0bacfadc15d1c2105a5c653ca70ebb0ca49a804aff5fc35a53849ac3acf756333a3a6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads