d81f27a43b773757fc9677b41a2aec43efbcb10deb185c2190443249efa077a3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f06964b4c1cc6a163135618fe2b3510.exe
Size

52KB
MD5

3f06964b4c1cc6a163135618fe2b3510
SHA1

4534c6a8acca3d98a655b7b31c83f0581c737756
SHA256

d81f27a43b773757fc9677b41a2aec43efbcb10deb185c2190443249efa077a3
SHA512

e413b5e8322d55542c650943f8a9bce9daa1500b8bf0b124371e9f058648e93e9527e8aaf10bbdda89cb2fc084738ac5625807b0ae334bf6e4b00331816e112a
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwg:W7ZppAp0

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4867) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\nacl_irt_x86_64.nexe.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\LICENSE.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	3f06964b4c1cc6a163135618fe2b3510.exe

C:\Users\Admin\AppData\Local\Temp\3f06964b4c1cc6a163135618fe2b3510.exe
"C:\Users\Admin\AppData\Local\Temp\3f06964b4c1cc6a163135618fe2b3510.exe"
1⤵
- Drops file in Program Files directory
PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2480455240-981575606-1030659066-1000\desktop.ini.tmp

Filesize
52KB

MD5
f71713aadf322e418226b790cdbdd0db

SHA1
11f9c87d676f42350bb4f0c20ffe831c970ee032

SHA256
e80390800cab0234564f0417abf909478f2ffe16aa552637ab6d82ecb7a09fa5

SHA512
ad1df4b25c6a4f45be90583918fb853a12f16b964409d70cdac2485baacf55d7660143781f417da8f5c676322c9b975e5677d0b67eda6990f586d00f8e85282e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
aae7e3c12faf0003c8e529b89f160ad2

SHA1
87918f7bdf2ef789b89e0adeb85106ad6d8f1dcf

SHA256
36c9c6eecfa435c5a63f3095cbae71a2f9e4a07d0076579c912885c183754906

SHA512
759185c07dae9fb5507171662911d56794c2d8a753017465598fccfd3c3a96cebc2d786c1a23fd7cddfa47d2161f6673e3854c1ce3083300b26e50b96710a8cb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads