7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4

General

Target

7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
Size

96KB
MD5

0074ad12e4e22386fd46adb48a63809d
SHA1

d0c7a90240d6fce0011baaec33e45e3af7e4a159
SHA256

7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4
SHA512

f2da9f58deed8dd14d77e62510c53509d8cd752541db5fb9bf49d63df431f565054a3908b49ddbf06d72b92c78cd1058cc3516f9edd503c855f230249f1d4691
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP76PDn+I+bpF:6rWpcOPxPke+e3fFpsJOfFpsJbgEODI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3916) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hi.pak.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nb.pak.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sl.pak.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe

C:\Users\Admin\AppData\Local\Temp\7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe
"C:\Users\Admin\AppData\Local\Temp\7ebaabfd2dced79a01f8cec28b0102b077dc87f088165246e40ef9737b4bffc4.exe"
1⤵
- Drops file in Program Files directory
PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini.tmp
Filesize
97KB

MD5
1b78886d5b50a52a79a29a985c65d8c2

SHA1
77af7493bc2cb14a6f56762a58616392ccdcde65

SHA256
4d32a37a366b9b778a2a51850c64512d6257883c62130ca62a6855728071c6ec

SHA512
1c012e432e9f960c3cf161483c8621428d0b4654edbf880b65c37e3c816d7c1df8b32bbb540644fcbc43f5ced4131a86ef624f43a8b38b16af414c0624532b2a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
195KB

MD5
707299bc51bc7e5340cc5f0ad0f62ad5

SHA1
0ea1c87cf094eebc059ed7871ffb7e485facdab7

SHA256
8733156b46cc975cfa0f569b2a8b65114ae6e7f2df9dad14eed599eedd7d295d

SHA512
4c0480f0266723b723ea091785b06c423464ffe602fc613e0e2da65de7ee0a881566f9dbbe9abaa02bcafa0bbb0dc0fd5d3b4eb8fd41d65f6052c3788b72361b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads