156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923

General

Target

156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
Size

47KB
MD5

3e7e484926d8e2f1af238c1e0d54c34b
SHA1

8b7b688da01430a75743b403d19cc2d63a0d02e3
SHA256

156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923
SHA512

b1878fa01589e544c08939ae51c0420b74c0128f93f40fea59082a27e30e11f828f5e35534bafa5aa649510b3c6ec3071e2a0da0115cb76527e85da6fa7f9de9
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1Msu1A:W7ZNLpApCZrt8PWGoPWGZ1A

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5241) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\XLCALL32.DLL.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\ConvertPush.xltx.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-BOLD.TTF.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ucrtbase.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe

C:\Users\Admin\AppData\Local\Temp\156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe
"C:\Users\Admin\AppData\Local\Temp\156478d7ce0c5d7eb0b98c8399d3ccb8776d3f7aefa58153ae80c986e4531923.exe"
1⤵
- Drops file in Program Files directory
PID:972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
47KB

MD5
75a7a72ae6df33e195c4c04f7b17f047

SHA1
c5ec35d7de15ddc6c4e58bdff63437a343aa0472

SHA256
e3f89fb1bd02c480d91f1fbc5c36f69ec4e1264ec0b8ebe8e1a24fa362c7cd76

SHA512
216734bd80a6ca35217f348fad28158756b84aaa78a2ff5c6e5dfb61f3d9af55ff74f1dcb9af100b2103e098a53b137c368d27ccb66c195a15ff7fe39cffd984

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
9bfa4cb1b037accb2dd65ff143cd85ee

SHA1
8ac4ae1e741ba9fc3a0ae69ccfff4599ed8df0b3

SHA256
8e9eefa9326a93d75289ae40c427d7f064fa0e9bf1be350ad3ece2b2d5e9e0d7

SHA512
e74986c48e0f7fef8b94d3e556f71381130a75152dc7b06927924138c4c05303adc6e6a4ab60d79876fae1f14a32cd0f718bb96dc4b113a74470288415832997

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads