00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
Size

81KB
MD5

60e1f7a7da5b3da176165f1e81a60057
SHA1

dbd906bf98ffc3ce630424ce80405f88c5e87d49
SHA256

00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18
SHA512

503eac9a4e67993742e152e1e073c904d975959f4d476053ca1c777faf64271676d44b5b77200b7b1fe12f3e45d80cb58cf68a5eebd700f8340882604cfe34f3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/5:6e7WpMaxeb0CYJ97lEYNR73e+eKZ5

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe

C:\Users\Admin\AppData\Local\Temp\00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe
"C:\Users\Admin\AppData\Local\Temp\00bd0ce241bf01e8dd73ad18f5bbce7ed43db54c32038047a3aded9d1e321a18.exe"
1⤵
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
82KB

MD5
e7b56b475f77ff181a6ec6f50b79152a

SHA1
5efc08274c933ee3ee5f3fb1314e125353240a43

SHA256
26b7e08355236079a1e8516c7c8ff0411bfe122e7a6978b7139232d6468615ad

SHA512
0b3dd03026dcb6e4afd48c6b1647829ec6dbc4645db5dbfab3fc317ac32bc636d153b146af0af03171d6c3f4c033dbd0e907f5f472ad69b8cce77eea3532980e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
180ce235ff45f5493766aa9074a5e647

SHA1
f9371a8718b87328cd51d59e632668589a5c104b

SHA256
669ccdd4b3cad96682f9372c382834e3ed4b04bdf9c8918189f2774a6352f850

SHA512
19b488d8e37b93cbb8e32595356ca67091322af932015ace2393e8346dc98f024fbaf1d10d5fce7957d04df2b74f61bb61334ae5ac21f196c2225f4bde592d50

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads