0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af

General

Target

0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
Size

46KB
MD5

760fee877187ee9048d7562f654f3165
SHA1

e80fdc351b7499efda8dacab780d8fd0bc89956d
SHA256

0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af
SHA512

de77f9463c9c77215ad8c0e478951f289e9349f4b7cb34f5a0c344da41bd2bdd58cf95e5709d48e0c471b2f5964685eb37777cbc5aa6b9e4939575dcd379c508
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsG:W7ZNLpApCZrt8PWGoPWGF

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5046) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe

C:\Users\Admin\AppData\Local\Temp\0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe
"C:\Users\Admin\AppData\Local\Temp\0f4433cf576a18765831a1ece32c9f92a0b0faad8ddd8eee7709928c30d314af.exe"
1⤵
- Drops file in Program Files directory
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
46KB

MD5
24e8b3c7e547f371fb247f79f6804f62

SHA1
0c95da8e4d1d965e47fd6e5681c76ba75929a08c

SHA256
b6c670365053afddc552ec80ede4206515e20a1b6338dd466771833e8b19d83f

SHA512
0bd552d40d28a31e3b1664b31e099573344bd62baadfd6b210e8f280a75f341eabecf5f0bf5f2e9848a1f6aef78fd741d111bcd7ef85acf8a1703d36cf7656bd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
145KB

MD5
5643743092d1010d997bc69c3d99618c

SHA1
023f272ceb7c220796657478c63bbf5a0350f8d7

SHA256
4adb54d63554d2f7084884eb2f47bc0abd8c30c5ad0c2052100edaf07457eac8

SHA512
ba252b5a6f139b2e5bcd2111b26226dfd6b9f503da457437d2c8acc5c2c2c587d6d8212fc4f6f5aa468a42232c3ebc654bf9701b9a13e1a35cbf76be70ef101d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads