c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c

General

Target

c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Size

80KB
MD5

22ec8ce09d9e8f76a07a203c3f60e05d
SHA1

aa90df2eff4a50809f90e39d564ba1779634b70b
SHA256

c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c
SHA512

d6e42b5b81c83248fc804d5df70ab281ac1a32894908a10ed1438e0921636f0e62558728e56e673dda00a7a93d40551544b3ce90e32dfaebc8b5b3b9a82429a0
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhn:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsa

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4850) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe

C:\Users\Admin\AppData\Local\Temp\c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
"C:\Users\Admin\AppData\Local\Temp\c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe"
1⤵
- Drops file in Program Files directory
PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
Filesize
80KB

MD5
6ff9888986bf4f205643b88c09838e95

SHA1
78d9aed54120a5704452adf028a6f4ec478c48dc

SHA256
ae0c5ac1a837191f093bbb0b2689bd4ac36beaa6c34fbc2c495444bfca93d799

SHA512
a81f89702eb0624af9b1f41543f2b097b4da5bd52d21dfc10a746eab406249edd0eb019b3821102dcad4de67015db67419cded0418783a78ad80a8e9ab184962

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
179KB

MD5
47f2114dbdff49c5f1f4572f5b2e32fb

SHA1
baeb15dedb0d24b8de1866b36781c18134ff2a48

SHA256
c91a58bcccb99b560320f95b907296e4ca86126966bbaf7a1103d8f496a5d150

SHA512
35ab379c57755ca6ae9bc37a8bb21d6b2058c345930da3ae6d5c7b62eba9dcd7d976e5dccc77fb55e947f68236f474afc3304ff397b77a31d77f6a7c4cef7c5f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads