d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
Size

106KB
MD5

6a61e780dc8761c100dbfd430087b9d8
SHA1

56258acb817368683598c4c02cece0b0972467f2
SHA256

d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d
SHA512

34f4448ce9520cd39ab00b404abdcd3fbff8aa019761e1114ed85614599e97877349ddf963fe9aabbb2a3782a53028fe9b25f89e46a7058e9314d2dfa133a291
SSDEEP

768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5pYJIJDYJIJOO6O2lpHiJOP25LqrH5HiJO9:W7ZQpApjIWe+eoO6O2lpiMZiMjj/

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5161) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe

C:\Users\Admin\AppData\Local\Temp\d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe
"C:\Users\Admin\AppData\Local\Temp\d51fa0f8ee5116dfc926f25574eea26991dd662566815a06fd715df99a4c7f0d.exe"
1⤵
- Drops file in Program Files directory
PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
106KB

MD5
0dd9a33b9b90facbee4218091c81053c

SHA1
7d7c7bfb582a686b20dfcb5809b74f84464251c0

SHA256
97a5b9fa47f2fc99c45257b34cf2d9f6194152bdce24912071f7be96ceebf6fe

SHA512
3c8909fd1836e5f494bb244ada0a036f499e0230f00e16a12d58a16182cf4cb2b22ef40426f894605d9eec76474524cca5e90afff12f1866cc90aa0f4c9a852d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
205KB

MD5
a75f20dd15e5160912084c49886aca5e

SHA1
4afb7394d204c2ee7e6a4f0a0eecdb36211ad16d

SHA256
9600488e29ca7b2f4a8bafa8efedc82be82171af060f9d4f202836d2479fa776

SHA512
a66183f3b8a8346d6b29d5e08fb59134f7a22f9101f236f6b729088f0ccd84c4761e58873f7f8cfcac87fb245a13eeda902447254560497dcd1e5dcf27412ea7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads