645123a47b6c6092fb27b51ee146d921b0a26db9d3bc6fc5f9448eca1ee7c8c5

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b1deed14d45b062a4ad0f9bad09fdb0N.exe
Size

146KB
MD5

1b1deed14d45b062a4ad0f9bad09fdb0
SHA1

980b11b690b907b2f3bff28728f484a5ca3ef76b
SHA256

645123a47b6c6092fb27b51ee146d921b0a26db9d3bc6fc5f9448eca1ee7c8c5
SHA512

72247102071b28d2f8069f1c607e18e9a21188cd9a8fe9fc1d788bd9760be4c4af9a018e13604ee2fb8c4a6c0f7f0c0f74aeaa416b325953879f870b9060c8f9
SSDEEP

1536:W7ZhA7pApH1++PJHJIOSIP7ZhA7pApH1++PJHJIOEOHi:6e7Wp1He7Wp1S

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4265) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	1b1deed14d45b062a4ad0f9bad09fdb0N.exe

C:\Users\Admin\AppData\Local\Temp\1b1deed14d45b062a4ad0f9bad09fdb0N.exe
"C:\Users\Admin\AppData\Local\Temp\1b1deed14d45b062a4ad0f9bad09fdb0N.exe"
1⤵
- Drops file in Program Files directory
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini.tmp

Filesize
146KB

MD5
ea3205873620ad67d0151d8460e2ba3c

SHA1
fcf30cdd3b2ec492789562f0599654d76d03a0cb

SHA256
1cf206a8ae06a75858150268ee75b48b85693d3ac54311cac13d851a728cee3f

SHA512
6fe4adedfd7a69657bb5d96e82a1576b5a378108820bc69455c9cf87e49c4a4a47ce4b26cc868f9c106d988431b10ac79d7eb8a3906a484f3e331950d09ca676

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
245KB

MD5
8f68ab5d0fcdb8a3067d4d7f4a72ca8a

SHA1
e63c8ac00a5bce89504bab5d25e50964a1fa0f5c

SHA256
bd2c9c2d3ef580eded02338eb8d8d501bdb6a423e866abfb2ea464222b711354

SHA512
65b18c06cfa2c9c2c95ffc3a1b268acdeb4c3fc01e7786415870cff09949d7a544438228ac4ebdb11ef9c15ab759dabe06f248225d6e53fbf88dac724da39646

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads