712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617

Analysis

max time kernel
150s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
Size

56KB
MD5

5bd27526a028a5f639c46912b605e489
SHA1

79cc094222056c163699b159814af71882ab4691
SHA256

712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617
SHA512

f8a05dec518c53b8cb0ff1b7f1392a99a8a08b15c5c32baf93a68263db88281c61ddb35f97060495f412cad081f01f43dc9ea7a5be7ad176cbbf55c69ed3fdbb
SSDEEP

768:/7BlpQpARFbhtF1XxXEhk8W/e/8aKa4aKa5:/7ZQpAp9XxXEhwaKa4aKa5

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ucrtbase.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe

C:\Users\Admin\AppData\Local\Temp\712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe
"C:\Users\Admin\AppData\Local\Temp\712d85e58c6e691828a5c5e55227a674d216c59bdb58d4159649676667a69617.exe"
1⤵
- Drops file in Program Files directory
PID:3760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
56KB

MD5
f40de8aadd04a4f1c817be868e209fde

SHA1
4f72cbf82ec97486e67d9b8b5c56750bcbec1ddb

SHA256
ad4e225bc93714b074035f4340d1d276d86e4eb666491d2bf8655319ce22019f

SHA512
f29255b412247c81fe49f0ae616c93b88dec5f7f2036dc88dbf3c97107ea295f226705841d306338fe99b7303ab3d665346890c36e955206731bdddb131cd703

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
ac59ef5953f3f3407f2434224a64dd66

SHA1
c6a47a8a372737d0af095c566757fabbef76bcca

SHA256
0f535be119cbaa1f68c077b43d74e7687225df4ac3f454c07a15d1985fe36f58

SHA512
edfbe00b828984fc03747313b3a39e7467c2a9d26cf0945b9b87b73fc418396347468837362b384050bafc72e21a3a4f94a4925c4bd06240f670ac4687a4e300

Download Submit
memory/3760-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3760-1988-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads