2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
Size

51KB
MD5

be0be87b345bb13082632c2da0d9ca3f
SHA1

ed5894a79e1edf94bdc30c1b4b98a5a8446389c7
SHA256

2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f
SHA512

049976adf13f9e69e63d5ad23e96a17e3a698b9c60432cbd33e9614c27980a2b225e702d0c0126238202068281d74ec384049ba8cd2e3375cd01f2b6f14a6665
SSDEEP

384:yBs7Br5xjL8AgA71FbhvgYJfPg7JDYJfPg7J8SqS9CDdeKCDdeO:/7BlpQpARFbhIYJIJDYJIJwd8dn

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome.dll.sig.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fi.pak.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe

C:\Users\Admin\AppData\Local\Temp\2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe
"C:\Users\Admin\AppData\Local\Temp\2ecb670edec0f2510a511c31f4464d4824623375234868165c26e67aa155a75f.exe"
1⤵
- Drops file in Program Files directory
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
52KB

MD5
b0afcf65c8bb4631a15a291b22309928

SHA1
4b5c427401bbd67842197280c12deee03aea56c9

SHA256
465ffdcd9168655d5170acf470316e9dea45dc78d133f0250e9083d8f229cfc7

SHA512
a3c2fc581f5be181af561e9659358e3950c64ad01cc18085641caab7add23397789603ee8eb2a68753554eaf72747e6842c2e92b5640b0795afbdb45bd187190

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
e7932b131868937afefecd3ee191670b

SHA1
dca539753f6ffbee884d950ab5af2f674484bc80

SHA256
b8bf16c8dbb21871a416a745d3efe592efc559a3a49c061537adbcc9e122ff89

SHA512
19c5bc7e142f739cd064c49bde57d96fd86f0de85e191b08bceb9ffb0d40e9b9a147cb182259ffc04647e4932496bd2339dfe1562132693a78421652e6a5f7a3

Download Submit
memory/1888-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1888-1750-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads