26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
Size

42KB
MD5

c1e1be9027423b8bdb53dd7a275be350
SHA1

641d77fec684e40894fb94da3e663ed4b60b9e5c
SHA256

26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7
SHA512

976ab61247ebc978988288a00020c86594b4fc7d96240267b75916218f55405600ee3f677a497d1ebb38212d0f59ae62adf8453df7827bc3d5fd807835e11d19
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNhvrmrkn4n4m2r:W7BlpppARFbhMK4oh2r

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4850) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hu.pak.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe

C:\Users\Admin\AppData\Local\Temp\26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe
"C:\Users\Admin\AppData\Local\Temp\26a746f647ff542f6924630dabeb06a53d903adde9f74f08ddaa23fc076c8ab7.exe"
1⤵
- Drops file in Program Files directory
PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-771719357-2485960699-3367710044-1000\desktop.ini.tmp

Filesize
43KB

MD5
d58d81e2533199d35635155f71a2a726

SHA1
b8bac217e656ac1f804fcafa99bbb90a8eb66ced

SHA256
25220bf6010de74ce63e2923df23dc2e3040e104d0a3aa6fd875e45a91776ec4

SHA512
a4a7a7d049af14a831768c9936c29ad92a3a4a3bfdecce9cf58c6eb19dbb393fd56b9b63e8a5a25c29a1bb73f21275eaabbf9a735589a7e90a2899bd2344003e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
2b6dd9fcdb97b8229352e0f0641dea9e

SHA1
02860a997cd46ae1e6465b76f8f2b198354bca92

SHA256
92ab7f2c107a125725f1d06d4e8b91bb3793e966dff34bc1d61b8faffe788af1

SHA512
7fd98884eee2dce035e52536519e36546de8c162b9288f05915a34e46b0ddb0d93497ee466c44f5b50c1f9241861c636a1385c0a926faaeba1909d7f1a41d8af

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads