1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
Size

82KB
MD5

cb51adabe1070311f5aaf6a682a3b988
SHA1

1220fb46c7ff8a1011017827e34de24f57eb745c
SHA256

1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8
SHA512

673cf1d8595fc0422943077b4a99961070493d469634a30c63c1bc82c4f5dd99e6b40a465edebae0ab3c57877dd54f8666cad8fef9b6994ad2d4a58b428a6471
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh8:6pWpUFpEhLfyBtPf50FWkFpPDze/qFst

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5036) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\el.pak.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe

C:\Users\Admin\AppData\Local\Temp\1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe
"C:\Users\Admin\AppData\Local\Temp\1be15ce5b8def39ced120505afa97eb9c9bdff3ef7f77fec159b4b07906b41e8.exe"
1⤵
- Drops file in Program Files directory
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
82KB

MD5
b4948be2d87b2cfcbc5394e16a661ea7

SHA1
b7dad8bfb51601c4cfd4253e8851d5451c8fbe60

SHA256
5b0fbc605ae7689d8fbf6d1a0123a0934c9a65bde43803888aaeedef31189caa

SHA512
3e896c2747937fe27718680e30ac97639b74fa64ffa0645a0087a77bdd4e2b61aaf1261cc3709b567b5fa7bf86ec22a2957a7b5c550a2d47cd19d282d0b784e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
181KB

MD5
85c91a3948c57029c1e155705c03f1dc

SHA1
678f3f6e51c2cdd91913fcdb1abd758dea726e02

SHA256
e105619984cf4980182c7058a5f67d6d63852e25c759bfc854b6a28618c019f0

SHA512
f7eac3806a76a118ff906606c5e7aa9006209fd2cc81c90f0f7733bfdf8206920f19527367041c27d7785e8cf75eb60f8dc5feabf7cf73b68fdf8bb5c1a53349

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads