7eb1c5c375cb87c9971f2dc9c07baf3fee6925a99a198327befe0ed186b9f352

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8333532ecc9e3a8842c68b45d33ecf50N.exe
Size

56KB
MD5

8333532ecc9e3a8842c68b45d33ecf50
SHA1

2af2e235443d30b1220a3e513ce7544feb8b48a3
SHA256

7eb1c5c375cb87c9971f2dc9c07baf3fee6925a99a198327befe0ed186b9f352
SHA512

2dd93b74c110c1496430fdeb7f0e626a21235fefe05ccb2a68fad21d371df2f874ad569c01622a8b835dfeeb5f8fe54ae47e8ef79bf857f54ca2c0db83abb618
SSDEEP

768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2FMfQsblBOi1xAfQsblBOi1xFs9:W7ZDpApYbWjCDOBJvlwJvlG

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4680) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\vulkan-1.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\pt-PT.pak.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	8333532ecc9e3a8842c68b45d33ecf50N.exe

C:\Users\Admin\AppData\Local\Temp\8333532ecc9e3a8842c68b45d33ecf50N.exe
"C:\Users\Admin\AppData\Local\Temp\8333532ecc9e3a8842c68b45d33ecf50N.exe"
1⤵
- Drops file in Program Files directory
PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
56KB

MD5
fa91257166f634814abb74b929225f5f

SHA1
eef3a1ddd248c158e778b4214a616c0cd939568f

SHA256
c3e8a8a52ba217182c4d3ac35bdf667777d1bca2d3b212c9fa2a294b5f3503b2

SHA512
a2b11b4c97ff8c19847922c7ff8ba21b8d4a805fe8b45c973a4d9be81a616d9453b269044bd4a9226ac4cc58e287cc10f2e99def71daa9875441bc72326f7a66

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
94ee8eb5c7e1ba280ff5e266ae05d5bf

SHA1
3383d5a5de637ee629c2f7effac84efd8982a1a5

SHA256
3aca0b10336ef4c3fb6cf9b8b2299b267ce8cd241d85d3b165c72f459d16b745

SHA512
5e7a7b62b587a3c20f136356b60473f7c77d0589e5d7278758679652f8ff160910f97f6868e35fd9b240820a6865eefa267405b0e377ffa3ca6e4ba8a444767e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads