204101e388d4148c6bc608d4833dc97837d9429a59969ea5d469de27a27dbc8c

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfe78cbbad40067edeb95de770be7403.exe
Size

99KB
MD5

dfe78cbbad40067edeb95de770be7403
SHA1

0eaa6852888c54df1a6ba63ede9eb3bc186d7d56
SHA256

204101e388d4148c6bc608d4833dc97837d9429a59969ea5d469de27a27dbc8c
SHA512

a9f394652b663f34b832ad0eead4f38d76ba81c006810b970164081adc7cc5d5749ef4826de38451f6c4094ca00c95d83c3edf846acc95aeb974595270d2f41e
SSDEEP

768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5pYJIJDYJIJOO6OcL:W7ZQpApjIWe+eoO6Ok

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Web.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationTypes.resources.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Primitives.resources.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.resources.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	dfe78cbbad40067edeb95de770be7403.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	dfe78cbbad40067edeb95de770be7403.exe

C:\Users\Admin\AppData\Local\Temp\dfe78cbbad40067edeb95de770be7403.exe
"C:\Users\Admin\AppData\Local\Temp\dfe78cbbad40067edeb95de770be7403.exe"
1⤵
- Drops file in Program Files directory
PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini.tmp

Filesize
99KB

MD5
1e7c6dda1bfc84b3e067c75a4d5cf481

SHA1
8b28a8e3ed43bf7099b062756fac12d1f67c4307

SHA256
598a812b616e3501a21c8e68b09d9012ba354a16d89ca78d2b9cc7b5117b7e43

SHA512
8358670ea80869e28a748aa74c4f252690e872d794e547ec850e4589a616c1f834d4e09e7b1c4e127c2316d62cdc890c3866cb245ce6a91f6e3442d0e13e439d

Download Submit
C:\odt\config.xml.tmp

Filesize
100KB

MD5
188da0acae9446b7ba885d0a2f034217

SHA1
9e5b2c2be030ae50c0c65c810039ce3da3047ecf

SHA256
e41ba2f903f7dbe1328f1a069549ded162fc443026184df711e271d1fede6178

SHA512
c472d212f4b9301e6a4a4bce10d99b22119c8d01aaf65da4269d61936a1116cf39d7846cd1f0d68614f7cc29ed1dec4980f700bba0d0164afb4b2e63087b9373

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads