1f11777deac02b916c0eff56bd3dfa27ed14733c377c2e88e081ecbcf32168f0

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15cf92d7c802aba15c2f4227221cff50N.exe
Size

54KB
MD5

15cf92d7c802aba15c2f4227221cff50
SHA1

78a1dc99ab93ac502f11b1d38284a76fa4df38ab
SHA256

1f11777deac02b916c0eff56bd3dfa27ed14733c377c2e88e081ecbcf32168f0
SHA512

5e86c4f096e25fd041beb209dec674d989601b2f76b9d5ab4dd7b965616eb14c077be6e865817745e6fec690ae7ac1fbd067468ae389fd8ba3946d65f829a594
SSDEEP

384:yBs7Br5xjL8AgA71Fbhvhwfziz63rmrHFl9GAl9GJZsTZM:/7BlpQpARFbhWGUKVGyGs6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4681) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\GetSuspend.ram.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\MEIPreload\preloaded_data.pb.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	15cf92d7c802aba15c2f4227221cff50N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	15cf92d7c802aba15c2f4227221cff50N.exe

C:\Users\Admin\AppData\Local\Temp\15cf92d7c802aba15c2f4227221cff50N.exe
"C:\Users\Admin\AppData\Local\Temp\15cf92d7c802aba15c2f4227221cff50N.exe"
1⤵
- Drops file in Program Files directory
PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
54KB

MD5
f78080ec9b5f3aefb2decc25e8889d57

SHA1
037e279c021cd7b523eec4807acc833f9f206e82

SHA256
1517e69f03c415cd1213ab41cf50d92fa9fe10f304c92448c163db804d0470c5

SHA512
ff1841f95d8de2b2829a52cb74440b1464d7ca4aa440de3d276d5ce1a3a79fe27a0b0e2204143de55e0b6e71b5d0ee5740cfff386e786fe586272dce3572957e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
153KB

MD5
2601e61031a8ac398dd9e367d450ede3

SHA1
f444581fe7c6ed6bbc60d2bcb7ec395e17ca7f5b

SHA256
95bb49263ee38071db0d15b3531019b13805334f5e3f033a5ec0a8586b50a62b

SHA512
a00af42e145d726df762a3b13c31cba1ed51da6bd9525e2d7476a2e5e8abcf71e9d9b3d42799754dcb277dcf990857f57bb8e9afacd31de307fcb759287d2e7c

Download Submit
memory/4800-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4800-1984-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads