c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895

General

Target

c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
Size

78KB
MD5

1b698468d409c9c9df58fd21f82e6f39
SHA1

5578172b4ca7c2b6cf5839ee5c3b1c1ca0a38277
SHA256

c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895
SHA512

8801dfeef6dbb68c93913e8dbb5e5716733435da0e1302f34861986208b72af005530d95679d90126c4ce2e8b00490e3a58f2c9369353497c036a79a2cb1a135
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRer:W7ZDpApYbWj2WTWJe+e/qXe

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe

C:\Users\Admin\AppData\Local\Temp\c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe
"C:\Users\Admin\AppData\Local\Temp\c68e8db870819184a7cf3ad91985861e7439fe7098db60e56a68794bf8b9b895.exe"
1⤵
- Drops file in Program Files directory
PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1428,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
79KB

MD5
d341368d66c43b36fd3be5f040da0a9c

SHA1
8148f7d72f427f29aa0d66dabe8eea9e152ddccb

SHA256
82588be8fb814bb5c839feb3a58910b3c3c71bdaa4e28b56a67903800062f6b9

SHA512
d5209ef52757d3729a4584dadc82ba8e5ae58bba85fd48447647f242894195853a5ce5613ed7933c30829a40cab7f4c7e433cbb1670a5722a7da18b67f40e0f5

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
191KB

MD5
cf6f248bb52b2fe03508af782c4467d2

SHA1
7deb0fdcf1bbaba1d185425cd5885146642785ae

SHA256
9a8e1c7d001fb2268fdd2c9e8e44f0ccf88181d212291376c5c7c31b525c8a63

SHA512
a97b5feb6b7bafa3828327d2cf5c2e779a98641af3ad30097557d65a23af5c7614aa9d75cf2c1452eb2ac542aeb8a6cf20da7a1c22771fa110a2d9c44f4ca29e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads