f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf

General

Target

f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
Size

93KB
MD5

5846ece68042a61374567e11c4878106
SHA1

2f03efe1d21fb8f2db065daaf5545fd92b7c3872
SHA256

f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf
SHA512

569395b883d6762afdbd11670eacb50a9b55db1fbc89315b9cdc9e4ba54261daa23543d9db210b5d3c4dc97f678fea23e4f46c5b957a3688cfa9cb85f133b84b
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP76PDn+I+R:6rWpcOPxPke+e3fFpsJOfFpsJbgEOD+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4985) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\LICENSE.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe

C:\Users\Admin\AppData\Local\Temp\f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe
"C:\Users\Admin\AppData\Local\Temp\f2bb13c253d9f509fedea6d6cacd8d002907c8cd4b261727262e58ea856400cf.exe"
1⤵
- Drops file in Program Files directory
PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini.tmp
Filesize
93KB

MD5
b8b3c9a8fba226afd7c5c382eebfe23b

SHA1
76481035ed170652f349806ca013171d2bf2d415

SHA256
7cc9cec718fff51d482e125413fa641c9b16fc214079e406545425a50943ef5e

SHA512
5423d30f188f931208f990a867b1e1c032ca4c20fa49f4ae7bbb7ce2a5ecf37a0a6d87d77e57be2dc071f12b85b1cf072b8a0c13c51671bfb9a5a08b7355e242

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
192KB

MD5
03d6c448373aa27ada9538c8efc334eb

SHA1
cab9c92c580bb684ad980a9c1a5f47a271e5a9a8

SHA256
07a28652c643d4bca2c440793d2de5a4c6c3fd3109ffdea7d7b125822a0eb04b

SHA512
637035d8d3eff4089a028d649f70a26bf5c35beaa817528cd2d1756adb8812d7a3532067cc9a313616b9f9a2978110fa95cc89c96d38a24161ac38dc30770f23

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads