e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f

General

Target

e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
Size

84KB
MD5

6ebdbbe2ac1383127f854593ae01fc3d
SHA1

0b6aae46f10a3dea731389ee326f6f827a4561bd
SHA256

e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f
SHA512

04d89aaf33ad830b2e4449501a2a0b2fcd204d97c4b08c1d2eb530b460bcb68a362b9a129e7686d80842ceeabfc594734e1e3bcbbd8a6cbc225bba41f5d198e2
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhx:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs0

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jre8\lib\deployment.config.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe

C:\Users\Admin\AppData\Local\Temp\e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe
"C:\Users\Admin\AppData\Local\Temp\e1c711c39504403edf60683c62fe32fe98e1688cbaa2aca5d6aa01c5dbf4c12f.exe"
1⤵
- Drops file in Program Files directory
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
84KB

MD5
76c03c04c65a989c40bc128d747e1998

SHA1
1bffa832b00f0bb8ff1998486614a509dcdd7149

SHA256
941637c1b8283025e124e6f24b7e72d9240348fb53ec442521611d0c587f904f

SHA512
1669f72ff62143e870009250184e0d922f256aeddacc9e46ab573ae5e49dd7032caa913904dfe87a2a7420f85a7934ca43a62d3ca9d4354b57c15bafdf1b1710

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
196KB

MD5
6b0c1e3199c03b6b8a7c81bde9adefa6

SHA1
7b6937da5fed2bfedb823f1f402e979850ca0191

SHA256
3ad0bc570afde51ccc06c558069ab310ad9cd3148eb8e140aba076b71481022a

SHA512
eaae43d08c2f0dac9cb7f2f987cd915af655347a9b591e85237cb5886a6fe39214d3e5f29ade8d9042024e6a919854065a8ddb0d77efa4de52ccae374e00171e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads