83435c02d6e659d1a1bea64b7b23322a78038f34fd209d424a782a2e921595b4

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
Size

77KB
MD5

bd1bae7e9b31ee3d3b72917e50b43bf0
SHA1

98595e0c766d0b69c561ed65665cae3dda297fde
SHA256

83435c02d6e659d1a1bea64b7b23322a78038f34fd209d424a782a2e921595b4
SHA512

01f21b01d799057e9470e616eb1af6f4ed7d93baeb0c0028e53041809346372c23eff8b8fa4bd5d3cef9977ddd9c903e0bc562258b11d81bb38c7a7f106dcc2d
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOMETC+cI2I2MkPMkz:6e7WpXYvnh34

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ca.pak.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	bd1bae7e9b31ee3d3b72917e50b43bf0N.exe

C:\Users\Admin\AppData\Local\Temp\bd1bae7e9b31ee3d3b72917e50b43bf0N.exe
"C:\Users\Admin\AppData\Local\Temp\bd1bae7e9b31ee3d3b72917e50b43bf0N.exe"
1⤵
- Drops file in Program Files directory
PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-47134698-4092160662-1261813102-1000\desktop.ini.tmp

Filesize
77KB

MD5
143cbea11a1e9517882cad4bc7750c79

SHA1
2f0e946999fe564966ff184fc7ce0a28812895b6

SHA256
627adb1d2d4012719abb46bbf8b1735626c6f2cd84682af2c19156dbbbbf6b54

SHA512
b01686d8139b21f14a3baea9d07a787a72f61da78b8779825c27110cb4af72eba8ebcf540f1818f9b2b5c4ae93f2d6d599013f1857e9c37d92bdcaf5ae276494

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
9c85251ccbb7dcaa54894e6b82231b64

SHA1
752d99c6ee7be343b17853201a76f5e48a119c4a

SHA256
4e190da1f5944a2ae9e163dd6cd9ded53e43f64b77a49628096a60bd94e32618

SHA512
7abb695b4130ab76bf4c0da45e5549ba8d65895271e4819950a9d490f541b7f65cb55ae0be8821593e9d18229309b211e93c00c480251da14774bbe7bbbe4b5d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads