77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
Size

63KB
MD5

90478b6488f4f1f047c4552d8ec1d8d7
SHA1

3f6fe361aa0bf111feebc1d6faface0d80871973
SHA256

77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4
SHA512

f317300055c978c3cda5a36efa5bbc9c4952c7fcfdab810f1ac7065104ef9d856449048a258b6b66cd3b8195edbf856c4995cae6d7f17ecf3854dc6f2e6b2bdc
SSDEEP

768:W7BlpNLpARFbhblkYlkuvIYFWcDYcDlvcYNnVvcYNndx:W7ZNLpApCZuvIYYoYoN7n97ndx

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe

C:\Users\Admin\AppData\Local\Temp\77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe
"C:\Users\Admin\AppData\Local\Temp\77d99fb517785294b8773b2c8c61ecfdf143edc7716a28b234ca47f4a23e20b4.exe"
1⤵
- Drops file in Program Files directory
PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp

Filesize
63KB

MD5
c08101bca89af79ad9ac1ebf4c3e845a

SHA1
7c107067d45bb8427ba034262c33c6da6f34c84f

SHA256
3cd0acf385a25be7f76a6ac2769a8283951c6426f91bd7dd5657ba955fbe2cba

SHA512
ce3ca65652a807b9200c22c2b8d6a20a466065cceeddf6d412cc709bfecae3942620d4942fd2d38b24851ec7fd809cb9bf3957dc29d83ff1d29873dbec30b249

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
162KB

MD5
116c5063a0f57493e0f77cbb9dcc64c8

SHA1
6e7e4b67be7f2f61f950b58bf103ce6779ced3c5

SHA256
b717e4252b790c63008f7c11a9dd94241fda36d6577f333e1bf0dddb001c8c1b

SHA512
2846269afa3e3cacc82fa3d7fb831cb54c64a8c8ff7ccf669f51499c91e47738015f009f225a8a0c7c6c2aa8c2ce333327fa868996c5a02a74d2408b073ba5ad

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads