a0a2ee8dff57ff87cc0020f0fdb89d4257a980ffcdf21a5028ae9068d2bc4efa

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47e3c20eacd09875c6ca2fcec50d1270N.exe
Size

94KB
MD5

47e3c20eacd09875c6ca2fcec50d1270
SHA1

ab96bb7bed3f9ae89c8da9bf91f3ad7712df2ac2
SHA256

a0a2ee8dff57ff87cc0020f0fdb89d4257a980ffcdf21a5028ae9068d2bc4efa
SHA512

cb26710cef91760f76788024c9800259e613b94526a5b9f0062e3567bc66b129a264ba981479e28cf4a4df3248d4c4cb3f31aba7a3de3aca0dbe41ca2edee65d
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfxRfxuAv9NRHRJ:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7f

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3996) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jre-1.8\lib\meta-index.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\th.pak.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ml.pak.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome.exe.sig.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	47e3c20eacd09875c6ca2fcec50d1270N.exe

C:\Users\Admin\AppData\Local\Temp\47e3c20eacd09875c6ca2fcec50d1270N.exe
"C:\Users\Admin\AppData\Local\Temp\47e3c20eacd09875c6ca2fcec50d1270N.exe"
1⤵
- Drops file in Program Files directory
PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
95KB

MD5
be4feb2704a8feee80306296172dcb1d

SHA1
0d85b561304ec170b30ed0e95b5b7d87ceb6899c

SHA256
c4283ae5051272309dd640a904ee9211c220c6c12e2be30d0283dc975a45ea1c

SHA512
be36ea03c72d8ed1e8b597cf7b9cd83d14c580cb8c05a5b7d6ff4be2a4e9c254a0d809f67027c982d2a48ed61b46baa4e90ef86da2256245dfd9df14007bfac0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
f86a2c16b315be4ba78f79f1f1fa3ffd

SHA1
fa64046e30eb52a0c0a9ffaa9f469a2d5b8468ba

SHA256
b01116c51b83563d6e057bf27275718bf7d3d24ff3a917bc55c7698eac8d8427

SHA512
bf2844102d22ffeb21f9392ba8dc2bd037420ca2df2e59bd87a45d920b59d01bf8db4a2e74a09f60982d011c417c2bb32454cf4d4791dfc4d6c2c47b0edcc1ca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads