c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072

Analysis

max time kernel
149s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
Size

101KB
MD5

d5beddbf4f58b1d4fd629ed51d377e2d
SHA1

bbab802fdbd5e80dfe0d3166e6a93db2dc80162d
SHA256

c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072
SHA512

f592313576cad28302871e60712274470a2304610c6ebd8dab3b853e8412168350a10e6babb954a660f469b5aba81c76af50967c7d6a3abcb62955a00b0e2d5c
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7ftCVHa:RqKvb0CYJ973e+eKZOf7ftCw

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe

C:\Users\Admin\AppData\Local\Temp\c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe
"C:\Users\Admin\AppData\Local\Temp\c1e689b3af76293c0af144cc706d7679848d225a1527e658e86a8b18b0417072.exe"
1⤵
- Drops file in Program Files directory
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp

Filesize
102KB

MD5
bd7d8117f892a513d6be0e9148a73598

SHA1
eb22b98056eb5aace61abecc4c3026d5326d3f8e

SHA256
9f994e4dec010a2fb90e99831b1c2ada27a082bcdffd9f4f092073536c8a2069

SHA512
18385c7c7d171ca57520fbe37b37c9a8652209bdc83d91a252c8d5e32414800490a7b6ecb57bd6b30b9e7175c3d459f47fd2261e2d2c5afc71420b1ea5e19080

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
c16f7b2d134ee9d8504d4f48e4e71f21

SHA1
2a5167a660d92899f03483c711ec3175fa0c1cbe

SHA256
87e2e7f36f937736227fef1617643f64a540dd766b7e78a88cae24b9b157953c

SHA512
a0e88c400d6d467103148b7d25beba9609c522b9928e83b5e285d5845d39fe9e11c5725e37509cb6d1aa9c1f28fb82de8cd1031ed03c97c663a588551b66468f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads