2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2

Analysis

max time kernel
157s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
Size

53KB
MD5

2613e6fad9fb44faf206dc58462acedb
SHA1

8a58d8b985378b90dc48abeba7ceb3845b836fbf
SHA256

2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2
SHA512

66f9068ea209861930b98fdbb4ec2bf068b0d13342efafa4403ade7f1f1c5d4b25320c8cc6c61af1e62fee53a678bd7bea6b2c97c2a656995a543d4970352d69
SSDEEP

768:W7BlpppARFbhbt7Y7zPhwyPhwdOwOfG2c4LczqNM:W7ZppApIayaz2pc/

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (231) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\CloseGroup.M2V.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe

C:\Users\Admin\AppData\Local\Temp\2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe
"C:\Users\Admin\AppData\Local\Temp\2c4811eb9340207cf2ece0bcb205fd07e8eaf7d9cd8233dd16d23915643f10a2.exe"
1⤵
- Drops file in Program Files directory
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
54KB

MD5
4179cc8b9e1634df7e6b0598dcf0d159

SHA1
a29d756e4780324fa8049ad03cdfbf05d841f5df

SHA256
34ccfc649796e19d50c891eb21b63c0d74669208b954b8a8a48638d6ea587330

SHA512
753278e244112f454e09adb4eb092417d4d339f71e3d5ba85d97f84ed64d682d4da9b866ec6f40586cb4a6ed9862d97f8691b14641230758753448dc170bfe49

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
53KB

MD5
5e1928c8a3f72b9d2013a9ced14fdb70

SHA1
d217208f590634edec33df4f9701b37f9e2cb2bc

SHA256
7832f0d7255f62cd58990e745dc5cae9728a4dc3c217ce85998baaff0fdf2142

SHA512
63e731707ac86c0bb88ffcdd313bd25c1d2998fcc00b34d84b16c6fd99d641c61ad9caa66df3c7c89449765ce67bdce31075d404e99a19296d99f7ceacf94215

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads