3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f

General

Target

3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
Size

90KB
MD5

6404f58831ae7bc556590b7e219397d5
SHA1

092c4ae5f441ba185a2f3ed5246a1456f74cf8ea
SHA256

3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f
SHA512

a70ab07f68fdaa739642e31f5650c726d32b3e970dd5c1e18c8c948445b6c401c3a3c4977dd9f26ef1e49f97d94367c0e1e3b3a6f4d35be64632abfd35c8d143
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/ejJZJ7r7raRHBRHp:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0zKf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\ExitWait.ods.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\eventlog_provider.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe

C:\Users\Admin\AppData\Local\Temp\3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe
"C:\Users\Admin\AppData\Local\Temp\3b35ea3bda683673e3faa24a72efdb9743299b02c2ac8c9a4c4f32fb6faaa26f.exe"
1⤵
- Drops file in Program Files directory
PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
Filesize
91KB

MD5
0bb24dd678a604ebe65c35844daececf

SHA1
8b14e7465d20be6ce2f32bb565e3af2454877d68

SHA256
fb5a2c4ffbff084f423e9f3dbda0543c5e235ba7c22cf7a551cbfcba08b915fd

SHA512
afc4155f6312331be593e773c8f1c8c81fb140c96529f5dafd70cbf42d02af60e29f7dfe3debf625c05b1dfec4c0f538a494eb29dcc931d12a7b7708a724c5df

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
190KB

MD5
650ac0dd9f419f14bc7e60a605b642c5

SHA1
2539573cd9b395e195c0586db0cc823bfa18e4d2

SHA256
ce548f0e2058bf91946313f1d439287e6ddff467c1d8d77b9208a37995028241

SHA512
ec7d236209b8a256eda7d8c7a0fc20d505f2f2c918443172935bba8a51ae624a21af04acf6102134eafe514aa0d5b6dbf4ba4d8d39b22069f506813b9af10242

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads