50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac

General

Target

50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
Size

94KB
MD5

1fecaba988a6d8ff551bb77e26936ab2
SHA1

7242ffa256efaa71fc55d8ef2b9c8bc40636b43a
SHA256

50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac
SHA512

2ea3c5c16ec500998fbf5031a99a3e7feed71ad7dd2a28b7094d48418ed6fc77f04bcc0d24d7e32f96813f10cc43cbe6ac321660c874623f7b139b58ec55e0c6
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/ey1Sy1BJ87J8H:6e7WpMaxeb0CYJ97lEYNR73e+eKZPVX

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4862) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe

description	ioc	process
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe

C:\Users\Admin\AppData\Local\Temp\50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe
"C:\Users\Admin\AppData\Local\Temp\50fc30ff32bcc30b9871b4ce24fbc78e5a63216f0bac25f44c8d7a34ac6d57ac.exe"
1⤵
- Drops file in Program Files directory
PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
Filesize
95KB

MD5
b61a1cca225006235f72ef2361d36c1a

SHA1
0fb5c98e9f53eb26e49c68106da7a51292e5afe1

SHA256
f49d2e538fb06d7572818003e530e9e7311373d48f7cdb3c2c7f0b81bc36a30a

SHA512
6ee4304fe40a8cddaf603df57637edba1de8439d9abd7a4cc0f1fe64b29d79c61a85e73db5ef21a2437675117e9762072b40c52000be3e46187a9c494a2d5bf8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
193KB

MD5
debadab067591f42018bbb44ff7169a9

SHA1
3b60df00cb7b78b3c8595214ab043ef3d1fce98f

SHA256
cbf92b507f22aa40bb49bdbe63eb1cc74a1718b5b0f0dabb7e3d8e7b6eb233d3

SHA512
6133cada339a4aeb9f0b42fc5e2de9741aaa17b566e75edc86bb9bbb2a224b37f8ca9f31b21766fe63578d7324fc72f7effc37fb77b267d958e00d58abe438ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads