e018cf04dc9c3dce44d9b4e9692eeb8aaeb9fd5998e2281e9e9e4868175e0e77

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cc4c3fc90bb2838aabc217212b4d1b0N.exe
Size

91KB
MD5

9cc4c3fc90bb2838aabc217212b4d1b0
SHA1

02ac5c5c324708b1c7297f471c580f6e2d96f014
SHA256

e018cf04dc9c3dce44d9b4e9692eeb8aaeb9fd5998e2281e9e9e4868175e0e77
SHA512

2151f0acf80625877c9b746a15d68a1ad07737adcc664ec86e1ce6bed98a5d59b30a2778d12666aa6e578007e1a2b0b4b094594a92452c7ed63ca16e2b28afd9
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tw0A0F:6e7WpP9oVLQthbYY9oVLQthbUrt7tw0Z

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4301) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sv.pak.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	9cc4c3fc90bb2838aabc217212b4d1b0N.exe

C:\Users\Admin\AppData\Local\Temp\9cc4c3fc90bb2838aabc217212b4d1b0N.exe
"C:\Users\Admin\AppData\Local\Temp\9cc4c3fc90bb2838aabc217212b4d1b0N.exe"
1⤵
- Drops file in Program Files directory
PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
91KB

MD5
2943f5facc15ad62359999556eefbfcb

SHA1
29455e935134d111e5d7bac164ded4e7be85a43a

SHA256
e8f8b8b7038864fad80d69fc1534903acb130adfdf6303fc1d66cab48e1e88b2

SHA512
f92f2024c20c0bf18cb6cd43396f0e8f132e1b768df8a11b119c965593ad725e681be911bef2466213e2bc29421bafe89b371366ac4b8330e875414360647b9c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
190KB

MD5
3d5278259f51d766951a78039c75d958

SHA1
99c915375b1da98b2eefde639ce5978f4795cb53

SHA256
1835e9f591971fda12b0aa6d3200db0b7b9fdbba85c70d07f3a7cf1b263abaf5

SHA512
63c33a88548b2fd521b30cd5d5cfae588135f0a2fe27da313ad95cdc2d17b8345f402d5cb9866560bac2c98b9d0bb2206b051d097c1bd19547ee9b6735fdcdac

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads