2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
Size

116KB
MD5

c2176f00b328adfe24b70db4a988a129
SHA1

3301881ba4b3dacd6a95f9e4f572a43cb431ac77
SHA256

2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390
SHA512

16f99d0bcb7d5a9de7b806eb20513a06a6594f09af0651ecb6f3a4b8ea4439d115a421b59103ab5f957fc0c22f57efe82d4e795a08eb2067bd337fb35b226cca
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5r8h:/7ZQpApUsKiX26I

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4845) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jre-1.8\README.txt.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_elf.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe

C:\Users\Admin\AppData\Local\Temp\2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe
"C:\Users\Admin\AppData\Local\Temp\2c19846beb5a697dba3d08b2f7be34acc858912a7ed12bf8c84f57ca45535390.exe"
1⤵
- Drops file in Program Files directory
PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
116KB

MD5
cb12bc0158afe72715a9a9159da4744d

SHA1
eac1986f7818bdc04fbc43958c72a905d8cb9004

SHA256
f75fbcf7204dfdd8b2b086e6939f703de63758896eba4e8519e56e5aeca6122b

SHA512
d4bcbd7290fe73063f3e38ad4136dd54e7384d343f555f101bcfeda32727d6cdefd9233748725d6ba1d31c92cf10d32162213481c723b7b16c67bc64b9714bae

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
215KB

MD5
2ce368fac3561e1fb42a494a352572fc

SHA1
b6e78c97282898986543357f7b0e921dd7290016

SHA256
234581bee8a1e2279fb76db1ec01ab932930537dfb71c0417291928880042fe5

SHA512
4168dc0dcb9daedebb1c4aed64bbc34d3abbf0c76e41da56893243940573fee46869ed4c198a6e2d5a26d5308a7773e815a31d8f49170e2c52bfe731a0425a0d

Download Submit
memory/820-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/820-1766-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads