bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
Size

78KB
MD5

4e2caed17d1bd9a5c2f8038873efe518
SHA1

1b65f5e566302d57a73c93680d44b3904a0125bf
SHA256

bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803
SHA512

36d744553c5b548a0411550e0e15bebef4057e43a3222b583f85117ed014b4de2cb5cd6a034a4ab2c641e4046b11c9491e9e142d29d8ad8788cd0e83fc358530
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVv/Uxy2a:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe

C:\Users\Admin\AppData\Local\Temp\bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe
"C:\Users\Admin\AppData\Local\Temp\bfe1d12d5ab7c828d1aab253a287996ae7b8eec6fba5e7e45c0e0788728d0803.exe"
1⤵
- Drops file in Program Files directory
PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
79KB

MD5
f4999245a779f67708f9506e20085fd4

SHA1
a36c1b59feb6dc79a99230e98c449219e4201abd

SHA256
30db8127a8c97b40e5b7937b17b37b8fcfb8d296fff8920a2e772cffb3260798

SHA512
2d33f298479fc1e4188beb2ac7454f306aec706c7cd975afce4ad3ac0d18588cfd6f020c8d3595f72b7a3168eccf8024084350ff5d76b751f5d498b503b868c6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
178KB

MD5
1a4c18f8c5da30b1de24dfce34e3e14a

SHA1
a0660179b4f58aa0356540ac5d80809443c0a65a

SHA256
e1a3cf842744043a619bf9818b504bcf4b9ba0ce4ef8360edd26f700713acb60

SHA512
195677834b76714b82d3aabe0926fd27612dca3211b592a37d1fa1af8a21f5fa4c1e998958fbb2f31d297d08c275faf926dd74262fabc111dccd0c6509fbf6b5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads