4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179

Analysis

max time kernel
150s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
Size

92KB
MD5

d11bdc6c66fff44d794f6fe9400fba8e
SHA1

d35b8e17c569acffda4db65b8e89f7ac01516470
SHA256

4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179
SHA512

d2e7dfe82b3928a80969ff45282e350ec80629ea00df0afb43efe9411f4aaf22dc46e45ad3dbbee627986d5ae7a96c28a11e728a489e8e6ca574f917339dc979
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNw:6rWpcOPxPke+e3fFpsJOfFpsJbgEK

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5035) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp	4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe

C:\Users\Admin\AppData\Local\Temp\4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
"C:\Users\Admin\AppData\Local\Temp\4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe"
1⤵
- Drops file in Program Files directory
PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355664440-2199602304-1223909400-1000\desktop.ini.tmp

Filesize
93KB

MD5
8659b3a0b085da50ec45727c0fdfd834

SHA1
36ff2b5b8d4a218b216a8d1700107954c8c7a00d

SHA256
3574629ac6d8c2113a8a8bb1403db5cd7ef8ebb9ff479ef4b03c2765aa1d7326

SHA512
a47ba6bb313e7591b506ea7ce91ca2f240c268c07c52f462a970e769b338ae2e70e1cd971d352e9ec2f4d1b6f2baf8875dc2bbe4d5f7e7dd0c9e19974a7fafc7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
191KB

MD5
d09e97a321bd7168e668b0c8c05c4863

SHA1
b4a6e5ae354147d25c0ae252218147e9792e2786

SHA256
69f5b5e04ea8e44c7201a6c81f2172b32e1efefd97937fd2d49c4215feb14019

SHA512
b9bdad3e42e51e8e1dcf5e04a2b810d17b37dde0d4a6218588d88adf9844f2dac780124e5276ddad9829efb21e2a938c476375defc7464112fdbb2ffca0f1065

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads