96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118

General

Target

96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
Size

40KB
MD5

440bc15de8fcc5a36884b6484cbf6510
SHA1

72feb5b3b3962b25286c821e194c544da271c1b4
SHA256

96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118
SHA512

8be6fe68fef56d693b5b442e0864ed54dae4c162c8643cde83d43ff3c1a6c278999d74de205c8d77989c37510dc8d99d80fddfbcd3fc06cac5a2ed80b953b875
SSDEEP

384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFwk:W7BlpNLpARFbhblkYlkuvIYFZ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe

description	ioc	process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe

C:\Users\Admin\AppData\Local\Temp\96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe
"C:\Users\Admin\AppData\Local\Temp\96027eb33ababe82745cc5950c624c60b0603793eecebbacb4336b64c6ccc118.exe"
1⤵
- Drops file in Program Files directory
PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
41KB

MD5
0f19e9a87a580a648972c294dd4a2fef

SHA1
76cc024150140acc0406a16d5e988b8b5f01ab2e

SHA256
8e4fcfa44c94f3ae657fb22bac1c801e3b19c68b0a0583a53fbc25372c443c40

SHA512
9d7df672b3ee059bb140a7c9fdf0c22f7612417680e1007b6ba99894b101c579e420e45fb9f779cf76f5143666c6c1b521568c60706752af699be05cd627c6f2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
139KB

MD5
70503141e25df1a118630712c4f52be2

SHA1
f2223bd7cd857d6f454928e73ebe2f531d42e00a

SHA256
c09fa655a91c279d7a6f355b4e9d77130c904ddfa71e19030a22d5334cbe9eca

SHA512
2adda071a186b2161653b9f2d70990bebebcf87bf194da0c1a05b3bc20f8c1c2d2718a09499f18042297289e69e28379e34badf63b73e84e7d96e450e2f3e2a9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads