b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
Size

112KB
MD5

2b7183d3f362ffcb27cc67e8562207b7
SHA1

72e82fafe4752431967a946bf44d2023c92adcd1
SHA256

b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a
SHA512

79aed9426423e09894a74fdc46ff56e9f81ad8ed5a6ba254a9fd59432e3b17c73cd7390745f57ecd5d31639cee06816a677e00f73b50ef619201d6d2822b1549
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzB:RqlIyFESWu0SWuGSV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4986) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe

C:\Users\Admin\AppData\Local\Temp\b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe
"C:\Users\Admin\AppData\Local\Temp\b2a4567e84045851be87ed1b0a4f7b13e4b4ec73e38c89df0b9333d9ce2fb78a.exe"
1⤵
- Drops file in Program Files directory
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355664440-2199602304-1223909400-1000\desktop.ini.tmp

Filesize
112KB

MD5
2a194c47720fe844bb09c48ce4ed82d4

SHA1
118d3c2f3926f09b4e0dc063177a77ed95b74ab5

SHA256
280f0a4c85e67e48763e7be3abb6655b47231bd0bd6f9b8939c3a830bd2e6634

SHA512
78421e1255148515d5d9d766ec122a55ce822be72f58df8cb826ee577141121a074bc995150e0dc35e7ca1679926c512f6a15798978d312322b0a9498954c905

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
211KB

MD5
4a0ceeaab8c1e0ae42848452bbeb98f9

SHA1
dab39df7f27f9d38757379d4c528ef840fd3439e

SHA256
21c5680e6134bb9ad622041484de736d734c625ee110e01a7612387b6acc676f

SHA512
5744cd603b648ab78bb8a2eb894bbbeed47ca0bf54f2e4e017fc6be4c8b996d53cab84aa4d4d6acfe1a6ff2b4604c408f5870b3a47bb91ec73f35e93f7d82dc0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads