941736ec39acc2920792b6bc94a0acadac9342cb1593edfad96e8a294c333d74

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 05:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5916edb47eb436234d13561f55b56140N.exe
Size

45KB
MD5

5916edb47eb436234d13561f55b56140
SHA1

836f309b404bac0c30df45bb38b5c51decd0e974
SHA256

941736ec39acc2920792b6bc94a0acadac9342cb1593edfad96e8a294c333d74
SHA512

2ff44ad69e4a44eb3e2b1c1ba997c8a18bb25e8cfa990d2403f9234ea1c6a4b9dc6d1de902647fdd8e53982e5e38197fb43d3a5f01bfc2d40ac083d711af0df2
SSDEEP

768:W7BlpppARFbhbt7Y7DotcOXiJOeJOFiJVcOMiJfotcOXiJOeJOFiJVcOMiJYMs1q:W7ZppAp51eNQ1eNj

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoCanary.png.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\af.pak.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\pl.pak.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	5916edb47eb436234d13561f55b56140N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	5916edb47eb436234d13561f55b56140N.exe

C:\Users\Admin\AppData\Local\Temp\5916edb47eb436234d13561f55b56140N.exe
"C:\Users\Admin\AppData\Local\Temp\5916edb47eb436234d13561f55b56140N.exe"
1⤵
- Drops file in Program Files directory
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
46KB

MD5
7f22be8f27db3140e6590b95d0ec1ec5

SHA1
600a6b64fed4cc943a20afb09184d66563bde1cc

SHA256
36d4f1afa92c74da1f69ed7910a2b3b6a8fd7f7120cbc253cfa8f257c14b56ca

SHA512
4a54b3678aaed35c2f99f6849c41010015bb9c8c0f513d0197285e63f241f0d35bfe74f2aab7d89c766be8c6dfe3e30bd289b6a5ab11d05510f5ac4331a4968d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
77213720b877d820ac7b5ad9b96f3f63

SHA1
74a6d730fb05cb79bd7021dd7ac084af99a94041

SHA256
9efd567015e4788b2e2266a0d6f60baf7925f0ee25726e0202ed8a7b854aa5e5

SHA512
e3e7b9f43b1fbb03f60973b088b6f336eca0db1dd3777b38702a4a31c656fb60ee3b719503e1fb8136e91911b1fbe0ef10d1435da9e761dcf6bf8375c2052492

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads