d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628

General

Target

d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
Size

127KB
MD5

5e988b1b46385bf5db116c2ad53cb6c6
SHA1

f9ab2c5059e443dd5b2804a4afc7eb5d811c4f7a
SHA256

d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628
SHA512

0f298b2de531193792692c91f3e1decfffe768846d545fee6f4799da61f210239a0ecb3b70a7d60835b9828525af78e6208b484868f9b24851836e2151c1f3ff
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzE:RqlIyFESWu0SWuGSwxn

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4870) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe

description	ioc	process
File created	C:\Program Files\GrantSet.crw.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sl.pak.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe

C:\Users\Admin\AppData\Local\Temp\d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe
"C:\Users\Admin\AppData\Local\Temp\d9d6a1b0959a8a8bbab0d8fc59b1639b12b82d37a316bd8588005cb63d5b9628.exe"
1⤵
- Drops file in Program Files directory
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
127KB

MD5
eed533cc7ce83adfe00f2b351253c0d1

SHA1
140c441561e032a849ad0c6eb058da2fdf99a05c

SHA256
91bfdd964c757888b98d5040238d19ad68ac6feec185c31b680323b0c4823148

SHA512
fef222a54d48f2b9095668718199772235b76f0f1781cb74496ccb311cbcea6a1500fa677db1f4d1580d7c7356b257219ea49d954c62fb63900d3d668fc060ba

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
240KB

MD5
990ae24efc00ae704f6ce09eba7dac29

SHA1
370abc623a97411016ba138e7c498d0b228b7119

SHA256
f5ae138ff12ba3481d477eec0a7d2ef4ca48833026f8ceb1ed62d7f832629b2b

SHA512
c6f88a6ed8467758c5934698a23aa717a3a99df4f841f141c74cf33a3a9252ebfa44797e5a1ef331d004bedea8987a806161b3a16a4ad9a52e884f381a5f0c74

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads