c5355c08ae1b584248f602c8797d87f7f52ff701e6a3c18b9d4e2caa1b38202f

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c49d48a2db08ce9d693818d285f803f0N.exe
Size

95KB
MD5

c49d48a2db08ce9d693818d285f803f0
SHA1

f3f5030f5f01718dce294a91a74d69584914cdf0
SHA256

c5355c08ae1b584248f602c8797d87f7f52ff701e6a3c18b9d4e2caa1b38202f
SHA512

1b568b98b72c8f13ff4d463b973ad06a931e33dab9daab5fe4f6fae873d1bf3c3babb04e370ad6ed91fc83b3a7868258969498f9d97b4bcc955dbeafdedfc99a
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVv/UxYnnZ/:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcp

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	c49d48a2db08ce9d693818d285f803f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	c49d48a2db08ce9d693818d285f803f0N.exe

C:\Users\Admin\AppData\Local\Temp\c49d48a2db08ce9d693818d285f803f0N.exe
"C:\Users\Admin\AppData\Local\Temp\c49d48a2db08ce9d693818d285f803f0N.exe"
1⤵
- Drops file in Program Files directory
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
96KB

MD5
82a9cc8b434a2aba9f047bc6001ac0f2

SHA1
68915736e00cc9d04f05f4049558fd574a0f0749

SHA256
1be5219e51edf71cbf7147d5f880362275769a465108187b54aa44da9476e0c0

SHA512
af1d023043e7590cfb346ee205dca017705f5d0870a4bac239800ca1e6e216d117829592a19d9ffa49fd68ad3e14b6535cee819c5f056f3a54a7829d2dfc6613

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
194KB

MD5
16f1f8d1c818b8e3818357133eae05d4

SHA1
c1a5b7199e8ae541ec9d469c8194120283e5cbe4

SHA256
3fccf076ed2907107485846a6ddea694d539de6914f01e903ef26f99e8b1802c

SHA512
92ed5b54fff71b087cd7800d950ea436be830298d98735f7e055c91d010cd8136991b0717315ee037494c29550ffaaac6b35e8761cd8d0ab78a32752319bcd2c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads