f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1

General

Target

f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
Size

46KB
MD5

89b1457d3c03dd671735956f5919c945
SHA1

b2e8387b9aef493ee0e05fcd926022180c737687
SHA256

f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1
SHA512

daef68a46c172ec6c1a6bd8687ddf65cc63f9254eb39093f378a00225b2edaf4e1e8c052cce08a254f910ca2e9786a0888439339ff535a2f87063685966508d7
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsQ:W7ZNLpApCZrt8PWGoPWGL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4852) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe

C:\Users\Admin\AppData\Local\Temp\f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe
"C:\Users\Admin\AppData\Local\Temp\f29d88dc06c27785fbff38ea0755afdfdc79a1b8242266b1d1a50275fddcc2c1.exe"
1⤵
- Drops file in Program Files directory
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
46KB

MD5
102c3c6b5c0bd63d6814cf5f4fd28d4a

SHA1
2834800470d90b36fe943d7f91e9478774b8f603

SHA256
54ef947cb07373c24b7e5312ecd4dce1cac5471b3185a06c948bf0b1748593ec

SHA512
24e33221d7f049343066276aab3cb760d4e21414d53142e036a83537ade90a7114ea89a30951a1e150fc637ad9c58ff6d2ef4bc5a04b079c215e224299f4824f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
145KB

MD5
b3c46e9d6eb147e732a2779f8a579f27

SHA1
9433c1dab81695f173b3513821b9e0aa96b5e4c1

SHA256
e7e7aa92ffbe7fd7ceaf8a6d7357abde8a154b2300913a51e6855e8f060e97ee

SHA512
5806d505ac70e6024057f99b9cfd804b483790fd437b0d3fa512675ca6d2f328a4100a28a1c4e5f0bc53bea8817e9b705f1c801b9ce18d7a8717ea4461f26f51

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads