8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0

General

Target

8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
Size

50KB
MD5

771926dd1d0ae973c5c3a888c523e60b
SHA1

9807e25d6a912d2fb18193f62fac4b44526a5e91
SHA256

8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0
SHA512

8a14f5dbcebb182d1f8a6418abb8abd6381377256e4e26eab786a57867b01ecdf20fdfe69d9bc93587f9faee78c43a0c24577912ecc9a397a23e946e71602cdc
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nb:W7ZNLpApCZrt8PWGoPWGANdNb

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sk.pak.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGCORE.DLL.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\MSOEURO.DLL.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\mojo_core.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe

C:\Users\Admin\AppData\Local\Temp\8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe
"C:\Users\Admin\AppData\Local\Temp\8af9a3223d64f53e43c708078dc355a4c274083af5a238681b564ce9ef9108f0.exe"
1⤵
- Drops file in Program Files directory
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
51KB

MD5
0818014d0dba899981be5706bfee10fc

SHA1
824ab6a6187300045f617b2154c7a160bdfbd4b1

SHA256
c912e10a135ef06ebee91ae0ab250eb8f4a53d1716a73753f42091ca2566533e

SHA512
26cd0adb37128dcda0c49fe92c49c670bf8df2d7969d059086260fc2b0daccd0ec5196aa509f48221b612390fcf3a999b94502af3f6ce6f00ab1453d04de7617

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
149KB

MD5
6c76057b14ddfee328ddaeead18936ff

SHA1
afa10967a91679ea5ab93cbe525647bbfcff5c6b

SHA256
5d32966528d31234111f575fa3e8e9ad422157f36c19b9c051aeef4f934c1f43

SHA512
eb4c73c638c4c60997985edd2593b0d76983fb654d6e228017dfc5af6275222838cfc2224ed3cce689f1c41ff6918c412e3490a9cbbdd7130fda91dc11805451

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads