f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5

General

Target

f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
Size

82KB
MD5

1ac438d458f55d4dbca5132d813fdade
SHA1

908abf50d4d3bae1940f0b96a91148bdd8c51471
SHA256

f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5
SHA512

ab6651c645d2496ca0c1b3d2cee72fbec7e87a141704277e0467dcfc88f5383ace1bfa9574606255df0749ce2931305c7c22a1a9e84479e3d52ff6941b24c28f
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YWtMQQQuMd303f:6e7WpMaxeb0CYJ97lEYNR7ZtR303f

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4820) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe

C:\Users\Admin\AppData\Local\Temp\f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe
"C:\Users\Admin\AppData\Local\Temp\f8b86507b0e22b383ea8f5269f6e19aa0ab3f840ab905abdec45577b67cdcfd5.exe"
1⤵
- Drops file in Program Files directory
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
82KB

MD5
d34af12f633a1f2e776a83970fa1fd12

SHA1
39bc0db27a41df9bf51a9a6f3bc5ccf9d0d790b3

SHA256
4404de967724c695602afc80715cb97cbac2c0e8ec39f58cdd3c72dec5719006

SHA512
bc9329962fca121d4695449e4fd404b71f16e19639c943150eea9225453a7c732809a570dc499d30c5f3bba2328b56a96ad1d8c5bb8b5ec01d9df9d2ff858384

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
181KB

MD5
9a9d51be4e4312a1cc4cc3088d1dcef9

SHA1
13729750b1a74e790bdc298fd7d2e4a009bc57cc

SHA256
996942d2e56e8122ac3c1737ed06eec26b0b20f83ec6db62e3b420cc6e9741b3

SHA512
58fb34052c15a1bbc8c3892573cb5916633b43652a623a07a4ca2a01b3cd1137738f33ff8d37f62f950770c9ddafc865506d00db32d4f1942ea1225610eed5c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads