8d8f074e9f072fd4a778695f6be3798d89d585d4ff5fe2e34e1a324651bebe0d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3371cddf4e72ff2f6389a46850c47410N.exe
Size

31KB
MD5

3371cddf4e72ff2f6389a46850c47410
SHA1

6983baacc8adf602d6b48adfd86b4ccf6a71f006
SHA256

8d8f074e9f072fd4a778695f6be3798d89d585d4ff5fe2e34e1a324651bebe0d
SHA512

1c827cdc2bfd341da800945819b3cdca9680e7da14fad3198d1adb0a1021de5cab7b02d75fceacbc406610b771dd4d0bf913dafccaf0e712861a8861df7910c9
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6GOVv:GBt7Br5xjL9AgA71FbhvuNBNwVv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4696) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\vk_swiftshader.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	3371cddf4e72ff2f6389a46850c47410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	3371cddf4e72ff2f6389a46850c47410N.exe

C:\Users\Admin\AppData\Local\Temp\3371cddf4e72ff2f6389a46850c47410N.exe
"C:\Users\Admin\AppData\Local\Temp\3371cddf4e72ff2f6389a46850c47410N.exe"
1⤵
- Drops file in Program Files directory
PID:3460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2480455240-981575606-1030659066-1000\desktop.ini.tmp

Filesize
31KB

MD5
647126fe1fad59d85f3bde9a845261f7

SHA1
c0ae152e336f344790c04b7c5f03f7e4d85eca06

SHA256
7bbdc1fa62aedae85eb1e9f016355596d1b9f335abe9add04d0aa51d4a5bed86

SHA512
be04e60efb627ad880e3076423cf68c559848cceff947845a46de9a5435c25994ba5abb8ace19fbfb6981bd51e4b6681a7ebe61c43085f0c36341e77cadec772

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
130KB

MD5
3310bef2e3f0a60b9e9a68d874575132

SHA1
e5c34429c291cfb58cdbbaedef4ec714daa5d89b

SHA256
fcc2b69a4f4bd854fed5480ff3f281a8782130603d2ff95e095eb656782815ae

SHA512
c7d1e24aa43b94e3b282667dd38d6307779bf72e5302d2cfc846e7440449b84743db0bc143a0abf5ae37864c3da3c56919df00636ed27c2168b55b4598c5d409

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads