12893aba8eba6932dd419f09430841d597f81f0381f505491886c98bf0dc2a60

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

062bcd68e3e168500bad91beb9e04670N.exe
Size

84KB
MD5

062bcd68e3e168500bad91beb9e04670
SHA1

43fbaa6bb493be663c0fa8329ac26c358ab6f211
SHA256

12893aba8eba6932dd419f09430841d597f81f0381f505491886c98bf0dc2a60
SHA512

829317a8f8756ea5299135e3316c900c2681c3da60809f174c7455b36d5c04fdc96ee8c519a5bd17af8a64a902e7e521cbc65fe439fba6397eaba0e096fb94ec
SSDEEP

768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhZEV:W7ZDpApYbWjIoPyPoLzV7c6ShZEV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5099) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoCanary.png.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ta.pak.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONWordAddin.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	062bcd68e3e168500bad91beb9e04670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	062bcd68e3e168500bad91beb9e04670N.exe

C:\Users\Admin\AppData\Local\Temp\062bcd68e3e168500bad91beb9e04670N.exe
"C:\Users\Admin\AppData\Local\Temp\062bcd68e3e168500bad91beb9e04670N.exe"
1⤵
- Drops file in Program Files directory
PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
84KB

MD5
6f268ca745d8dc708d126d2b4a630d1e

SHA1
b16864b178ad197f9806bbf434baa3aa06ee388d

SHA256
c63a9a138779d02cf8cb85e08ac79722f2db4d4e60ebc1f0cef404ec0f6d1657

SHA512
ea16b65c6ff34efd40a4f36a485f53fb04cc3baf291190ec8fafb17f631f270f7681655c4df5b3ce2247bf2fae9c201d7a518d1bec20471de6b97396e9366b72

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
70b5bb36992d06d55f73f8776c49de19

SHA1
262847d2db4164cf36adc78c179830b0f60cce02

SHA256
759a9c2faa92e5f6e86e22cbbd33da14e0fcf7fa26407d5e918232584dc3125e

SHA512
ce67efaa60aefa9688f9026841d855a99d878bda8564ed77d8de1235410cafcfd14abe74384dda63f3da99f433eb3a8f99061381b04e16ab59551e4be1028d88

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads