966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0

General

Target

966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
Size

100KB
MD5

1a2107331ef73b929e3a4b9050a60760
SHA1

865a3ea86435f7ef498684b5b6bc516724852ad6
SHA256

966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0
SHA512

e283de14657d0abb8fb9817c6c1ec65526d13e97dc6e654015ee45ff00405855aa5f2aab6a2f0cf3a9d0b27c54f8dd6582cb8a0ef1905b80b7092d4de66678f9
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOfFpsJOfFpsJagI:RqKvb0CYJ973e+eKZ6gI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4857) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-PT.pak.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hu.pak.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe

C:\Users\Admin\AppData\Local\Temp\966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe
"C:\Users\Admin\AppData\Local\Temp\966d486346dfcacb6cae60950b5a7fad70d913752f2f76f0eb5a12e70fec2bc0.exe"
1⤵
- Drops file in Program Files directory
PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
100KB

MD5
14ed1963d9dfd49138de84c104f3392f

SHA1
d99ac6865283713273e5d3ae782210686160f4f6

SHA256
630fdeaad9389fbb0b4691ec88c4f30f82d2715168baa0a64a9c7cf29062729e

SHA512
c36157d91a33fa3cf4afa18eeff765a1836910deedd87c898923f5538e7afaff023472d1f724f81f4f1c9e34a6ecca5124d3d03a128ad1192407448ff4de9d15

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
199KB

MD5
c5154247be7fbdaa24e3ac658c853280

SHA1
ce35de26d4d244d4dba2012fc3126859efdf4608

SHA256
68f3a7709dbd0adb470f26dae901b5ea86de13156147a7427bfdf4fb326f83cc

SHA512
a5b99a42e3600eac075440bfb756bbdefbd6c54569c93f9096f6f6d49beeb2d90c828258ed6e2ede3542dd0b5547d6896de479c04e063f70c776efdc2b557e18

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads