04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f

General

Target

04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
Size

82KB
MD5

08f30c2cbc2b53e2963894a5a09c69a0
SHA1

cc8a01a14526dcc234f30e6778932eb2ad2ac38f
SHA256

04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f
SHA512

2ef5a100ad52ed17df6c2755ee647344edbc5a47698ce98ac01d3e5b33e9d85eb7962f08020f8d911f1e2ecd0fa8dbb8bbc9a1eaf52184374d7432f17e53fc02
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/6lDMJUDJUR:6e7WpMaxeb0CYJ97lEYNR73e+eKZaD+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5017) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe

C:\Users\Admin\AppData\Local\Temp\04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe
"C:\Users\Admin\AppData\Local\Temp\04962be508914bb2f625427b07fe555a0667b805bd30f4342f7d8d9bacae054f.exe"
1⤵
- Drops file in Program Files directory
PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
Filesize
82KB

MD5
d9f76023873d98d6886caf39ed640f53

SHA1
513f10ee9cffacf1c0ce9362bc5944e9db7b3091

SHA256
9aaf4f460d105a5e6f1d13f0217be3522476474443bf3501e3919171eb97ce0f

SHA512
12a1c20bf79edbafef451e4a166df62c784edd683dc9423ae817d31e7dc1ba1c41e8a84ae62b8c47cc85d9de728b4d98c26bd01d59d443839df987ad9daef5c2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
181KB

MD5
4f3d0070008341943cc3263ce14061d0

SHA1
20f99b5340ba1a34901a8d5cd7b7dc8136542ecf

SHA256
9a04e86589a9747bad68833dfa6f8ac14a70e7d8a6786a4366195995358073df

SHA512
a792281d192338f04f339baf96a254c232b8806565bda0a64926fb4b6547bf4e434bc986f9d5fdf002761bdc9b285417952fa94ad1703edeaecccf3fe6fe89d1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads