70649487ae720e8d8b1f072396b054f5d9f66f2f813ba97fda1138d2286dfcdb

General

Target

6838887bf0043e2b17f93940c3b8c4f3.exe
Size

59KB
MD5

6838887bf0043e2b17f93940c3b8c4f3
SHA1

d40e49e59a110050efd9cd4aabbb119a44f55dc9
SHA256

70649487ae720e8d8b1f072396b054f5d9f66f2f813ba97fda1138d2286dfcdb
SHA512

419cb0f09f0287ae244ac0032222229f75771235ce0ffeb9ead358be63bab52f3b38051b1aaf77a3b26558bedd104e4901a28ffacc5f4f875254260925950306
SSDEEP

768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2Fnj28/8UMWMmlHlc:W7ZDpApYbWjCDOgj28/8vhm1u

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5093) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

6838887bf0043e2b17f93940c3b8c4f3.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sl.pak.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	6838887bf0043e2b17f93940c3b8c4f3.exe

C:\Users\Admin\AppData\Local\Temp\6838887bf0043e2b17f93940c3b8c4f3.exe
"C:\Users\Admin\AppData\Local\Temp\6838887bf0043e2b17f93940c3b8c4f3.exe"
1⤵
- Drops file in Program Files directory
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini.tmp

Filesize
59KB

MD5
8af3f2c26ac3b4968cf3a209f8a59d44

SHA1
6a7c1bf1f26005b5366f68e286462e2cd88428bf

SHA256
bcc2715c3eec65daffbb2ea152de01526a892f9a3be2878ebb41d5348e961c45

SHA512
1413295fda82afd8d78edde0bdb40d34d1df13701b8da0391a83daed727a1b2d4314070315e635bab423a96f1e96610ccb75674652bb19224359c6d36e7a8898

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
3cbed76d39e81a4738c0b1cadedff7be

SHA1
6edba1a029995fc048e5803fb7d977f9e8de08e4

SHA256
0f6b16dbcc763b5f8d7f6d7d8188b36b9b9b2d4ff92713e3dc3b4c6fdc3c3a2e

SHA512
c4f4a9e4c0f39bb9fd97b2fb668833178d5bd0831b40e7494be2e85863ed9dd02cf57a1e411f620bdd72aa400a287ddb105ab7185c33e055ef63fcc730fd6782

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads