20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
Size

58KB
MD5

45870a2f839848087d70cba93f507b52
SHA1

ef8d04cee783229445c3904aa093ad3af8288b4d
SHA256

20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20
SHA512

1802f5f5c8606c1daa275efab11a31996ffb6479096033fff1c2d992643395667ad396efce7407d7d201ac93a00e1ec83cbf7ae0f5ca98149ad183ed6d69cb57
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nGrA:W7ZNLpApCZrt8PWGoPWGANdNh

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4993) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoDev.png.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe

C:\Users\Admin\AppData\Local\Temp\20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe
"C:\Users\Admin\AppData\Local\Temp\20b4cefaaa5f7a75fe5f7f259a1114654e0d1bb100a49e3cb9039e2b81416c20.exe"
1⤵
- Drops file in Program Files directory
PID:232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
58KB

MD5
5578d3cec250021d9d30b539d4e22ac7

SHA1
cf6e69145f8831371f2d79847170d1c855f385a3

SHA256
578da9c31efb5c47926d7dcf544002e3ad311d954455df44584e1777c4cdc404

SHA512
4355eb70ebf44ff669f749aaa1f129f1f12365846ff72296c8b2e248aa4edf73e9f5e0dba28e241ea838852a204d8bce60aecaf72820e2c7102e38adcfdede98

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
108af81fa55a9f12fb060fd28544172a

SHA1
59e56b37e964d36ecc26d7990678694e81cca990

SHA256
2e73aac56c6c0a6476663f2eeeec911e4d323fcda8e7166c635879a77981ae4f

SHA512
9f9ec62713ec3d474f5c94065c5c381ddac79efc05839d2870111684088eeb10bbcb944de1eb8da4b0762a8c703a9bfb0b2c3c0ae3eb76cb491beeec8ec1e3bb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads