74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d

General

Target

74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
Size

42KB
MD5

5277ff9c3801912c3cb9ecc2f9f940f1
SHA1

4313bfde5b48e13d14f20f3110045c19c8869c76
SHA256

74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d
SHA512

fa530cc9cc7606509b267e339d04fd13d518f5aff7ce185f25882bd4c789a44d78426a09614df9460f7896eac53229f197972c0a12a9412fcdf194f384f248dd
SSDEEP

384:yBs7Br5xjL8AgA71FbhvgYJfPg7JDYJfPg7JF:/7BlpQpARFbhIYJIJDYJIJF

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5241) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sw.pak.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PAPYRUS.TTF.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe

C:\Users\Admin\AppData\Local\Temp\74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe
"C:\Users\Admin\AppData\Local\Temp\74911b3b6185b63aee9adcc53b182c641b402b202c095388a15ea4b2fcbf228d.exe"
1⤵
- Drops file in Program Files directory
PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp
Filesize
42KB

MD5
87748f74eed8531e1da06aeb020e5448

SHA1
1a171546cbdd9919e2fb717bcb3db95975f09f23

SHA256
5bcd1d46c01876624653203578466e197d53fc040181eb526a706fbe2a02148f

SHA512
f20ac7d2e6d3789bbe89f1766f0be1ed0c9a3ffc27f06624ed47ef5d537a4294623e2855c0065defa7f6977ea6e188eae11cb71394143b19f0d83335c0804375

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
141KB

MD5
37b56e8fb73dcb488fb9c8da2ac4cb06

SHA1
74d0729e2a6d2ca591a162ff6ffa516b9d2b4ffa

SHA256
7032106db1d710cba3e53d1db14008ecc0182dc1716dbe2679ed0f5cac52f240

SHA512
48acb623fec245797c5c2339db5e9ab9682a80cafe7644039e67d6dbbfa786688fa15aeda332911762ad7efb84b7b16df809f9a51dad468bf05c8d63a0fefa6f

Download Submit
memory/3520-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads