0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149

General

Target

0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
Size

92KB
MD5

1a8f08d26664594fb06088b96ee22ce5
SHA1

5597cdbbd4e6e968512b2d42838fecd34f6ffbee
SHA256

0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149
SHA512

cab81000f19c9d3d48d02204af51ac13bac958f8dc46d15cbe34895d5dfef1e3cd4f8a8fcf04d3a4309ef7a383918bab987ce08bcc625b4739a1aff2feafa38f
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNJvxvg:6rWpcOPxPke+e3fFpsJOfFpsJbgEDJg

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe

C:\Users\Admin\AppData\Local\Temp\0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe
"C:\Users\Admin\AppData\Local\Temp\0a00021f2b31c6dde33736ec42008885c94243bc6451e8b6a1e30f81a344e149.exe"
1⤵
- Drops file in Program Files directory
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
Filesize
92KB

MD5
a58b212d656d420f5069ef02a18e9450

SHA1
73c7c71fbbfba5857b7bcc90615004ff338c26a8

SHA256
b49c942753ee30a982e3dea327f276b58f2584a1191c76a047e4305399bb7857

SHA512
4ff80d20bf25edb27c0b9192d45f53cd38d13c9c97198d89af9670e5253c5dcbdf00aecb09edd9a31d8eb3af77c0138c0c9e95d80b4b10220ef72283ec9dae7c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
191KB

MD5
c49eceacd46c780b9f6cf002c1804387

SHA1
b275f326bd5e40382dde21a7b33aae466ec90490

SHA256
671a979008094307eca62617ad46cc9c790d865b4c3ac52fbaed0cc0cd854d26

SHA512
c6c41a806e9f2358da643a6b5acf38b7641af50e9a09865587987b66a7f7384c29b2bf9b078bd761c78be814d0dc8f05315c3fdc429725e330b0dedafcd21c1e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads