43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
Size

101KB
MD5

ea67507213de471f7eae684dca50bf2b
SHA1

80c444fa83e82a529c064e33edaf721d85de0e4c
SHA256

43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f
SHA512

46b09cb1824f3816e84b01a0bf170688089aba0446526366ba67b369326275e4f8f0acfa566cd2ace2565a825f437f8ebc079e61329599da7c6d26900ef47329
SSDEEP

1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8Q8/8RYdTmXadjUSbcDemTP6yKze+yKzeS:Te76WQSoskRYd6W2tKzWKz/

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe

C:\Users\Admin\AppData\Local\Temp\43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe
"C:\Users\Admin\AppData\Local\Temp\43f2a20b88961165aee19d53a3f6d456a0b597b1246521032b3ce80a407b4d5f.exe"
1⤵
- Drops file in Program Files directory
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
101KB

MD5
573d7999114dd413568c8653c77698cf

SHA1
206a3fb0ccb9c7b3c6d4ea312fc2046dbe689e26

SHA256
d59b5775f3cb5dd0520fad37d68ded4644637dbb2402c44af930fdf8a142ea31

SHA512
97502c25bc35c64ff3a9b20082316e5167f4ee334cd3ebac9752404f3438bfd912c2f4763e48a05fd21668751d00bfa7dde202e6801f5bdb552cf0097f295cd1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
dea5b364e939a6b4aa459b94dd7ad7fa

SHA1
a918d3ebbeff7b92e09c531038844aed4ed629c4

SHA256
97595d6ba69a82b99d64d741516b7942b931c8b9d3c52a629eecfb146fde4f84

SHA512
ea5747ab961354fdbe949245af927f252525ec189ab3fa38822099180307f6a983a8028e175dbd47c42869b40e2dbb35e916bedb9df4420b48586d156ed84958

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads