68a710da671a2f84de8b75ccdedffd6abf8cbfd7c92ff6ed60ff9fb8c9850d44

General

Target

e5dc596bd4691282dfd8e1f23e520cdc.exe
Size

66KB
MD5

e5dc596bd4691282dfd8e1f23e520cdc
SHA1

10ed5c0fb45e11b9aabf2e57e5a9233c2b7d97b4
SHA256

68a710da671a2f84de8b75ccdedffd6abf8cbfd7c92ff6ed60ff9fb8c9850d44
SHA512

3fae0c8444a1936a3a924df897a7b0482b51150837360ff2e0876be7080ba44f008504ce33dd908b1447e90c8306a52909fc21ca077dc4143507df55c0ae2df2
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhz:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsy

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

e5dc596bd4691282dfd8e1f23e520cdc.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\UCRTBASE.DLL.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\DebugDisable.rmi.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	e5dc596bd4691282dfd8e1f23e520cdc.exe

C:\Users\Admin\AppData\Local\Temp\e5dc596bd4691282dfd8e1f23e520cdc.exe
"C:\Users\Admin\AppData\Local\Temp\e5dc596bd4691282dfd8e1f23e520cdc.exe"
1⤵
- Drops file in Program Files directory
PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini.tmp

Filesize
66KB

MD5
dd72c2dc88f86a995699600712253c13

SHA1
5776bd3c33933591933cc2dc440ee64f7e58f8a0

SHA256
dbe84309d640d9f33a9b7295d4acec5c872bdbebcbf8be98194e3bf1be5f7e68

SHA512
31dd83109859860d9da9e7548b374c82cef60c57d5a3fac5b63ba6992194c0295a103674f5aad98127257c3454a6499bf3e58668028023745e048a9e8ade64f1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
165KB

MD5
02020bdc50d0c3c048a7f4edf2344117

SHA1
d7f1f1b52762eba0723396955f5c2eeb03228ede

SHA256
6e3086d1065862014baab4345a7ef50a1fd0899e2e3b866a14d0d41591773997

SHA512
9a3f415f650fb24b271077e803945941aa4dcd1232dfe2dc3ccd3c557a564164c14a70633b4fe23fb7a2bbbab6605d95cfca517257c0182a623f70aae5c6fbbf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads