13c3e567bad76dfd3dde3d9156b982af363505e1f41041cd122ace8f607f1f1c

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

566fd4d114ae43e8efaa5fdd0c7d2980N.exe
Size

66KB
MD5

566fd4d114ae43e8efaa5fdd0c7d2980
SHA1

40b264652de57b47ec96fdeaf763a831fddc1eb5
SHA256

13c3e567bad76dfd3dde3d9156b982af363505e1f41041cd122ace8f607f1f1c
SHA512

0f0b5552b293d5b4d51cb44edeefde0d4e253036555fb0fefb481b61d2abde95d5447a9df4980f6f0c08639692ea8599de65cba87e60739dd878ec820f3a4d96
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrRYKYU4Qfxd4QfxlpC6hE4y4d1:W7BlpppARFbhWJq53fxRfxlpC6hdiiim

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4633) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fr.pak.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\MEIPreload\manifest.json.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ms.pak.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	566fd4d114ae43e8efaa5fdd0c7d2980N.exe

C:\Users\Admin\AppData\Local\Temp\566fd4d114ae43e8efaa5fdd0c7d2980N.exe
"C:\Users\Admin\AppData\Local\Temp\566fd4d114ae43e8efaa5fdd0c7d2980N.exe"
1⤵
- Drops file in Program Files directory
PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
66KB

MD5
f230c516f37ebd4a8e6eac3da09c7dbc

SHA1
1713189f57c601cfe2f5341751b3b350774c035a

SHA256
8a0f272e10adf3857cbb15ec9ef39ca557d31297e12180ae335077484b0d4a00

SHA512
83bebc0cb3eab29900ef2abdbc2a71d41111b87dbd3be4c9f92680b108055d592413bbd4f718001ca9abba4c2898bebec19b802f6de1e94d607404942af6ee87

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
165KB

MD5
85499f48cd8e76c88ea2b6f95d530171

SHA1
547215dda7220bf0dc9aa37e67f966d70f0371a6

SHA256
6ca87331fe78435ee06a78dc30b37ada631942d871141b2425a621b22c7fd64e

SHA512
489e6cd269d07babd89b3b0d28bfb4e5403ada193e139a2227a326c384133ef67f7a6045723f81fa15a2cf227a7161c85ac9c9a80e82436470d798eec7984c02

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads