7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
Size 100KB
Sample240530-3vg5vaeh4y
SHA256 7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20
MD5 bc568403952b227cb2a588b89aa11241
SHA1 9318a6d0547562598cedcdf8903c6bd9d7318aa5
SHA512 26f4783ecb6e022c4fab8496365a6330bc57d9f6e862f1d40d3e79d3ceeed76458432255f4d5b244eb4232a8abd315f58be7036a75a23548b095cd00cb81815f
SSDEEP 3072:6DWpDWYPxPTJe4cjWEjWqR/D5zf6ydyf+abMkF24kzK3jbrCkoRJNDNR/D5zf6yn:dDPxPTJAj9jl
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4821) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe

C:\Users\Admin\AppData\Local\Temp\7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe
"C:\Users\Admin\AppData\Local\Temp\7f9d0675c4405d170a3515d504f1eacde637b5faa194ff528d792f8b3e470c20.exe"
1⤵
- Drops file in Program Files directory
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 100KB
SHA256 3fd66cbb81ebe61b564850297b639fdeedc287cc20ef309449f24a62f9024ee5
MD5 c4384ac2534f5ff64ad1ba3fe4d106be
SHA1 115fb176cf4a73c7346f2d86d79727a4ebcac660
SHA512 f79b3850a1de88da79c2c2e448e273865a793433bf632f67ec43f6047269aff1b810616af5a80d22bd00f3377af7124c407ea98f3f5d7d685ea27c69aa7723c8
SSDEEP 3072:6DWpDWYPxPTJe4cjWEjWqR/D5zf6ydyf+abMkF24kzK3jbrCkoRJNDNR/D5zf6yo:dDPxPTJAj9jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 213KB
SHA256 7149db4def65d9d4922de68d5647743323d603381ce1b5999820a9164b893f3c
MD5 ff2a67f572aaa4f1315e89bab9459499
SHA1 23583219a46901954a1db021de5cac125ba1dd5d
SHA512 d84ff9e92e907e075648a51690b0d1720cdc26bd0cb0813dc932c0e441f56370f99ced30f39e9be09f1466bdce92dd333bb3eb0d28c456e47c8c189a054b6966
SSDEEP 6144:dDPxPTJAj9jLJ3a3LXGZkUcTb1JcrjQ4I:RPxPTJAj9jLJ3a6ZHcVar04I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads