c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29

General

Target

c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
Size

63KB
MD5

296e82029c3dd1b81421cc11aaf74804
SHA1

317430f03daf98f2b4ce29bcd9d3fb4447221530
SHA256

c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29
SHA512

eeac11468d9f82f65d343de3b28d1bcf9805189ec4b6fc835267b400e31d1b2be1997acd9eed1fcdd18d3171192bafdc910e44c3c23b339e9cf4adf0e7250b1d
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuI:W7ZDpApYbWjIlE77uI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5186) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sr.pak.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sk.pak.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe

C:\Users\Admin\AppData\Local\Temp\c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe
"C:\Users\Admin\AppData\Local\Temp\c4ec42aae9b4a2485dabd2d8293312635d0c50844d5042a45a44882434df4f29.exe"
1⤵
- Drops file in Program Files directory
PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
64KB

MD5
e47ce8563e388c5a00908a9594b2d634

SHA1
d38002e099f10bc0c8445cda09d5221eec0c3631

SHA256
e264107f718040c78911198fc5c48b4b1e7904b6a2f466c31f87007cae323706

SHA512
76d79772adc1b315348961b4efefda7a1ad3358ec6f59a273396416fa93031541e448b0f97ada82ed8ab95328ae74e1a6baaf06e1634d859082b48c392b8923a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
162KB

MD5
798af2bdec04295669d83168b11af3ee

SHA1
c27bda5c11fe1deba042ab43b6462e0f8806be33

SHA256
4ff24e7747fc533c010f98f12bee5c9020775052996dd5b14cede7d225960b1f

SHA512
228dfa9c103fbc049f21dc9dd7b6623f32b386864c2517b7ee5036c455c0f2d5ed2cd27517b6b80509a3ff109d38f9fcd7d2988a8819dd0b8fd97308153acc7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads