20de06845645ed178865b8c32d1a0f5eda090836cd0a2933ed58d74dd6297df2

General

Target

7fe5b0c10871ea040abbc7b9e4c9a08d.exe
Size

210KB
MD5

7fe5b0c10871ea040abbc7b9e4c9a08d
SHA1

ddec3c4c3ebe22e9c992b205c0b0c3467e6b6e69
SHA256

20de06845645ed178865b8c32d1a0f5eda090836cd0a2933ed58d74dd6297df2
SHA512

6cc7afc9f6315c238059aab3ed1556832ad2f761f7c2d30adcce9a344c5e4696847838bc447b6097cdfd3b2a7beb3d82ebef0e70ee928aa0f76aca0d3bc98e9f
SSDEEP

6144:RqlIyFESWu0SWu2shFAC2jnkbOupvuv+qM/qMV:tyosbpankbfcvK

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

7fe5b0c10871ea040abbc7b9e4c9a08d.exe

description	ioc	process
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	7fe5b0c10871ea040abbc7b9e4c9a08d.exe

C:\Users\Admin\AppData\Local\Temp\7fe5b0c10871ea040abbc7b9e4c9a08d.exe
"C:\Users\Admin\AppData\Local\Temp\7fe5b0c10871ea040abbc7b9e4c9a08d.exe"
1⤵
- Drops file in Program Files directory
PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-259785868-298165991-4178590326-1000\desktop.ini.tmp

Filesize
210KB

MD5
771c051ce13d7a10a2b91da4f1c291e5

SHA1
fe012c405a37ba93805582fd5252b1335eba48b3

SHA256
9a3d6e93843613ab9e4742538767766903c06f3f6fa37ebf16dbf78a67e97205

SHA512
86506ccbf4c7e6f3aa7a71a897ecfd588b9b7aec0e0f14f1bd4341e9dcdc6d4c6e3c5e44d395ebbcfbd095c1b7478dc36aebdbe1eff9f24cddd3d218e6872d0e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
309KB

MD5
66e6572431ebd8ff9fa4f12e707f472d

SHA1
126e0f351a3b8d88069f8aa82b101129d2eb9baf

SHA256
40bd7ee44a7766ee9116e3d3327f507a9345f5009fe095cec9447ec55d1d4533

SHA512
2a81cce303241c089200154e64fd71050fe6bfe58dabe7bba9df9e3d2be645f86c8ebbfbae3dcf3ccd0d1a58dac62f048d84b6030589467b10f79b2d62e06f68

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads