03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
Size

48KB
MD5

0bf5ac751362fb00097c01064529cb71
SHA1

2adcdc7e76bef93b8a8ea87ae0563226feeeffe9
SHA256

03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5
SHA512

b054e2f3566ca3fa8dff6bbf64a328a9055d6ada8ccc869ea17159dccc1e968d7fdfda587eec83104ff60209044b82f0595ff15f74f5ec80d48a46110389b1d7
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNi:W7BlpppARFbhWJQiE

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\vk_swiftshader.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe

C:\Users\Admin\AppData\Local\Temp\03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe
"C:\Users\Admin\AppData\Local\Temp\03d9505bdc0f41156291f12f8e5f2dc8d88f886d9b1ba75b80890fea6e9cf4a5.exe"
1⤵
- Drops file in Program Files directory
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
48KB

MD5
1837181f6707b01e620faec57d34d4f0

SHA1
48703d750ec3f3a2d1b34fb8daa754188f6e4dbb

SHA256
9d231d77dd5ff7af428105f8b502e56883efc1ba12d4d6afa17f62d3ea0c8d21

SHA512
6b3072d154a8fcda03a4b7baa021655d8c73c77ffbcb5428276e7f5971ef91d13287bfc5b6763bb6263f0fb8e562b0aa5f0f798f0b7c13487f681f64ddd64c5f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
02d6a853c1ef6a8129fd7ab88d18b1af

SHA1
1972d04e6d4f33c9fe1cfcb9cda556c37136c86c

SHA256
909dec8221ae67da4e5dd985ee3ce60656b30ae322285279786f48c91e8ce547

SHA512
dfab90ea532be2363a56c3a219bb959df1f696403573ed09872dcdfc8cbbdc5bd381485e6f4fdf4ee6ffd210287c743866475bb21ba4c39aef8bce542eca2f83

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads