bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
Size

110KB
MD5

1cc9659f0b88e7602f0a45af87aa9141
SHA1

0a2b61e4e3267280ad9f7c631c42ede38d0f8884
SHA256

bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3
SHA512

a855672dcf765c293533d176078f44e1d1f348e01df16a3c1fe23abcb476e4ce2d4b31d49485d23e311c8304d6bb78e7eabdd9b2a9021a68c88fb4c181cec383
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzm:RqlIyFESWu0SWuGSC

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe

C:\Users\Admin\AppData\Local\Temp\bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe
"C:\Users\Admin\AppData\Local\Temp\bb6fb30445bc3864061f4901a59eee2523891de7064a7b2c55b87b2f72a88bf3.exe"
1⤵
- Drops file in Program Files directory
PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-259785868-298165991-4178590326-1000\desktop.ini.tmp

Filesize
111KB

MD5
a2467be21e096b7131c7cba475e75245

SHA1
49424893fb637cfa0732950e66631964b53a749c

SHA256
b07a3fdd0ab78f2ec5809fc018995e3ac366a2d4072357cf48388dea3fdc85b9

SHA512
2fe92adb86723bc860e5852079f79104fba3fce8e4a5946a367cb842810ad41d14180bc0032ea961e4dd8300ac010ab1e4fa012d12ebd380a5d70c17505a4b04

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
209KB

MD5
0c1b5923423e6222c8e7a0a5354bc728

SHA1
dfd4cab9e4ef11128be8799a70a5054c602fc45e

SHA256
1930cf50d1e8560afb65271faa25111f2f2cbfcbef3f22a64383c097cfe069f2

SHA512
392ad2d91279fcc56daeb04b2832340fd7d561be7ce82931f8b60b0dfa5ac0eeebace0f85b20152b458b439b36db46034ccd3154615b47871038e5642449f1fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads