89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
Size

128KB
MD5

4a332868fa08418e4a53ee8173bade43
SHA1

524846382447024e0bb8ab1f185423eb4b70573b
SHA256

89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058
SHA512

ab808b6ce8d38012c664a333db74ae115baca8539cbd646a59ce09228b1cc1861d6b16b1b470c22b8068ef71f707d34f78f5fe2c95270eb0f91cbbcbd243a5a7
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c50KPKN:/7ZQpApUsKiX26Ka4

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4855) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe

C:\Users\Admin\AppData\Local\Temp\89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe
"C:\Users\Admin\AppData\Local\Temp\89468cbd15c7464a14c35b21cce78574a3512649bdb7a426e2aaeee200d98058.exe"
1⤵
- Drops file in Program Files directory
PID:4272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
128KB

MD5
e7b66720c8eb93e8056bd14cb3116c68

SHA1
fbb00162cf9fe826761fc1545b7a1203b90fbcb2

SHA256
97da79784eb96912e0f9687e716e0d1b5b3a1193c0b5aab22cd515e388f06230

SHA512
c113af6aa282791ba83bb726c6d3e5beca433192f4a7eca86a593fc6b932291c41afb9b80776de185e8c44e43218cf65f41f1910786c8d1f90549ad702960f3f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
227KB

MD5
bdaa345e9a30fa0ed11ded7cc41a4d23

SHA1
440112cef4463d042e6b7cf6f17287db11bf8d2a

SHA256
d800385dca16c8172cdc49b79c61d672f9b7c967613cee41186db2fe6b14af2e

SHA512
94e6fa877fd5598a8adb93b9a20bd4679cc91f7690f4ac9ba0186f3a8fff08e5eb4bd5929f93bc28cf0dd1c9768fd866ddb3a82dea3476fb0d9edb082c35c267

Download Submit
memory/4272-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4272-1726-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads