d79ce1a98a73bac7e542c94cd051eb596901bc53c983ad8395d85b7b6acd7101

Analysis

max time kernel
149s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

065854c707faf010dd871dd4646027c0.exe
Size

78KB
MD5

065854c707faf010dd871dd4646027c0
SHA1

b3b85cf96c7de8194e2a192ee277f1e51735c09d
SHA256

d79ce1a98a73bac7e542c94cd051eb596901bc53c983ad8395d85b7b6acd7101
SHA512

5075e70349b03416918d070e1ee78ab67a5c8cc899cd5be45e794c52177d647aa79a7a16e864368b4ab28424f112ca6d520ad7e0534ebe4aab6571c0763735fe
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh4:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsd

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	065854c707faf010dd871dd4646027c0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	065854c707faf010dd871dd4646027c0.exe

C:\Users\Admin\AppData\Local\Temp\065854c707faf010dd871dd4646027c0.exe
"C:\Users\Admin\AppData\Local\Temp\065854c707faf010dd871dd4646027c0.exe"
1⤵
- Drops file in Program Files directory
PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
78KB

MD5
f1801a60fdd2cebf45590278491cbceb

SHA1
d46377b90dcd45c031321d590a871a14480a5672

SHA256
10bd3dd2f1469d698ac838e27e41456363523ebe0c69759845e443e61e3fb30e

SHA512
133b33013a8ce131a5bc7b7077ce3ba9acb72910cfe1cedeb75fa855337f21304659cc59f19efc0f5fe285a00767c5825fde813da0ac73163c2a7e65d4838599

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
177KB

MD5
f6476d988308fcefd30f6621745ab007

SHA1
9c2b3bdac9b324b2a8fc6ef6dff58f99e31a4e97

SHA256
3cd376efb947f76999576826ef59a3b8388aed451c02837ff799d0bfee138de9

SHA512
dce0b3904a38af72f398ca7b47d3f56e614baada8c87f0ce58a31b3d5c6f9724af70192a47e0342dd22cb9e6f0cccb9edf7574ab12bb804f33319fbee1f67a29

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads