0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8

General

Target

0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
Size

134KB
MD5

2f89937064692891cd0ca8267161302a
SHA1

70d41fe493cc35b5c2c580e6795998625bb9c7b1
SHA256

0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8
SHA512

45268fc6e4bc19752403e93de8571851eaaac341fb8fe7000063bf1a5e9004f790c6b3b12debe5ed4b5640fde8af300c37433be7042fce4fd335ca9a5844395e
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5cfYfy:/7ZQpApUsKiX26C

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe

C:\Users\Admin\AppData\Local\Temp\0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe
"C:\Users\Admin\AppData\Local\Temp\0c1860215e726cdb46dac90476b70599d89e01faf4cd60552e3726ff5fc394d8.exe"
1⤵
- Drops file in Program Files directory
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8
1⤵
PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
134KB

MD5
b3c67a6fa54beae982e01574c8ec7714

SHA1
d247c5d8c4240e597c155d9d1816aaa93cf5996d

SHA256
7aaae5000617846e698a85f6c55ec487d95094408a6b8d65ceee2e420a1688a4

SHA512
0be85dfa1e31bc377c7215a3268e40f418c79ade388b3210bc1c3cadb961f610a21ed2f8e7482220002e1773122aeb710c37fddc8d74f87d6fa042993b2518c6

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
246KB

MD5
9881a86a46b9a6175d058b60a457d350

SHA1
f91634221fe5f6bfb1da99cac9271e0279772f71

SHA256
f05145765aa51de53db1809616866d503ff096236e5f7f64feefcea56db49189

SHA512
3454f0deda2d8d4110a4626006683731fbe4f8d96df85005b45cbcd294d99f01dab7ecfbf865b49f66f5db25e2f7751b2352faa109b5fa069e1944ee431b37d1

Download Submit
memory/1788-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1788-1792-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads