e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715

Analysis

max time kernel
149s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
Size

80KB
MD5

539ec72f7bed2f8e428e296b27d1026e
SHA1

b775644f87ae51d963cf3258f2d4bdb11ea126be
SHA256

e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715
SHA512

f5b0be788790428d944cd400542a67f3fda0dab0fba39efa6192e0a673befe00eda7f2b698cb0cdf3b0888c5b4ae5bf4ee63797766acf5306e7a80a90430916e
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJhG:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFN

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lv.pak.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe

C:\Users\Admin\AppData\Local\Temp\e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe
"C:\Users\Admin\AppData\Local\Temp\e452b92addf77aed5fe9464152784865d40d095b4447000d22cc8ed04ad20715.exe"
1⤵
- Drops file in Program Files directory
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
80KB

MD5
10df850c06b91351c2850a7e6a0a454b

SHA1
e0215054ebf9d8c8c92d65249f15a101815a741c

SHA256
b9ff46037c6d3c4f022b635f94856968157cd3a4a1d457844263af3966fa1a31

SHA512
a5a6500dd5166172de0274cfdb1b7eb95581a91edff35345d7f6315efd85efecc25e58217dd61568f2642a508f4f51027640aefecc86604b3c6f38bbeb0f19a6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
154860b48491be47aa7c16dc5f78cd40

SHA1
eb08a40c073be337e30ea0d74695a839b9816808

SHA256
1ac6711442dcd04ef72f71760c98de8f1f412a2f79d3e6cbb52152516901a7e3

SHA512
3d7aa7373d0d75a25848d4f1243a4415262fd6b7a3a454e7c7aec415d1d277613aa4dc21c8134ea82497c178388feb3941002b07b8cf4dd28459009029f6702b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads