0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
Size

43KB
MD5

5dfc959c524fd601c9d08d62722d1a2d
SHA1

c6f2b20a672b7b3733c15506571c51ceb948f60a
SHA256

0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421
SHA512

00e84d0034a96d3dabaa53ec112a374217e4d4a59e143affd61c46e5b08ad8699b8bc17a14ba1ffc68195d00eb88ffc3ea7a14ab5e97e13b0ce34d7e717d35a0
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6GATQ1nrvjjs2jjsX:GBt7Br5xjL9AgA71FbhvuNBN2TQ1nrQ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5292) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.ONENOTE.16.1033.hxn.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\el.pak.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogo.png.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe

C:\Users\Admin\AppData\Local\Temp\0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe
"C:\Users\Admin\AppData\Local\Temp\0799b55eea0a810089ba411cb2f158e1bdefebbdeb8fc7cd18c555e732d83421.exe"
1⤵
- Drops file in Program Files directory
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-587429654-1855694383-2268796072-1000\desktop.ini.tmp

Filesize
43KB

MD5
0a4d99383a2a4d6a3dff8a6e2364c877

SHA1
6f59b2f465f7433e4382a0aa18471c657f9644c4

SHA256
e088d4a04d276b53a5a015538006285a5c4c20cbe46cc66524013e2bb590a0c5

SHA512
4f5e18b90e8d59ba372178af8bd458c37a566708c080135f02a7a38cf07cf08e7de1cee86eeb977c285cc29db10d7010c5340f45e1a5e5e6b05a61b717a1c5a8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
598088f1133d0f425b7a542c4d694e03

SHA1
c568846927980d71b6292d3a49b2b5f519e5e697

SHA256
689a6223b466a7bb4ca6b9a70f68685caf5ef2b0c12979bf4608115b6b83c7fc

SHA512
b669494f20ed9d5cb5a7657f7cb8f8afc4f4deb16c44f98a9428009fa671d05701c6108f449e68680378c069e0fdfa6884d7f970262d722bf35baa75fffe7ed0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads