5cb4645968087b667ab8c32f71eb3bc050e71f84624f1d41180390e76a5fb14e

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dd4193fd76d6ee46efc75b07ae472e0N.exe
Size

198KB
MD5

8dd4193fd76d6ee46efc75b07ae472e0
SHA1

aebeedb323297c6d930c3957e625483a2f082ffa
SHA256

5cb4645968087b667ab8c32f71eb3bc050e71f84624f1d41180390e76a5fb14e
SHA512

738f5faba9438d8c64a9a388aac70703e745c9da0693433ddc86835f6152fada8eb46bc1468e485284f66625504f1d48eee557f61bc7bf98b06e8d51744816c4
SSDEEP

768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qs9lRlCM:W7ZhA7pApaX0aX09rd

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3996) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\mojo_core.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\manifest.json.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	8dd4193fd76d6ee46efc75b07ae472e0N.exe

C:\Users\Admin\AppData\Local\Temp\8dd4193fd76d6ee46efc75b07ae472e0N.exe
"C:\Users\Admin\AppData\Local\Temp\8dd4193fd76d6ee46efc75b07ae472e0N.exe"
1⤵
- Drops file in Program Files directory
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
199KB

MD5
9036b2681e7748aa62f28095bfeb0dd2

SHA1
e0950b51cbc8e64fb707824fb014e66971739a6a

SHA256
491bfe9b4c5b4bf525965035fede15f1ea5f6616d5c15a987e0741ecff1189d6

SHA512
5f1bca85cf0192241cdc473e2cdb72ee984e0ab652dd6be3f8cbc2a3d02c2f1c37c557d440c5dd1804fb7bda8fb716d276c36b524723b60ebd44a87fd7184916

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
298KB

MD5
40512dee17e530eed2d483b571a7ccd0

SHA1
1931d19c79044c691af2628126f9c83af05bbbf0

SHA256
4e2055a6842dcfe3c2405d9aa9dd3c8f7c4f37bc6d43781a5cf8cb9d484e2239

SHA512
1e8b64b2ab14b2073879f34c8f0e494918f6ab110332fec6e1fad6bfa5af6bfc93c1be20a4b1389afaf72c79dbc3c0c8122f174f527555492e81d3f29431dd52

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads