e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
Size

54KB
MD5

918d88c3ab2393791195b03b06a1aa03
SHA1

ede086d697c9464322c38586829cc30ea54fc536
SHA256

e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1
SHA512

e730ed73eb20d38009879e959dd17db080f34ff40bff5c6852c17345fcec758d23eabdd47c8e9f9109322322bc1abc47b707f5491e265237b83537290583bf62
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5n4Ad4dAd4M:W7ZNLpApCZrt8PWGoPWGANdN4uOud

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp	e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe

C:\Users\Admin\AppData\Local\Temp\e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe
"C:\Users\Admin\AppData\Local\Temp\e8a4af09f675524ea6ece4d084ee190218fa1f402d8d11ad4fdf7afcd6aed5c1.exe"
1⤵
- Drops file in Program Files directory
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
54KB

MD5
33e7072081e46840ff1564e034504a46

SHA1
2f391f96702ea39bb98b4f40cbbfbb03e2e8cc6d

SHA256
16410fe0bd8c1e309121b8f396501b0bbe7b7b16c636f09c605d31bfa443ab23

SHA512
d1d3cd38926fb64c0ce3ae54a82ef284291caecf9839f70740b7cec6f9d41e3f0dcc08154cd1a4c9d184f10c2b2cbb197c782bf502be4333fcf2e5846838fdab

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
166KB

MD5
9dcd757d600f34ba666ed7b38e7db518

SHA1
008979d97161613bd879fdd5c645e8fba23e72b9

SHA256
f1650bee93a5eb2caa7f48084de02513f0ed309c11b4bbce629e17309f908eac

SHA512
5db817814010044188ba0ab8ff1b3bd8a405f2471020df412e592458ec02a36b925becbeae9fbb796af73a8d7e5ace3500ddaca0a3c7bb95bbf98d35a480392c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads