df310fcb510c39b3f6a2cf0da1645654faf56d811c30690fcf5daa21a734008e

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e6864330dd4a1578af1b7cba23e1afa0N.exe
Size

89KB
MD5

e6864330dd4a1578af1b7cba23e1afa0
SHA1

13bac9b0749f79e5fa580ade89bf0136789ecdad
SHA256

df310fcb510c39b3f6a2cf0da1645654faf56d811c30690fcf5daa21a734008e
SHA512

df7c00deebddf83392400feb3763b4ed987dc4bc82e6d897bc1ffbe2038070e7f7135630a5c62f586647bcd740419f685d8c4dbf4d7bd3f88f108a3dfc14289a
SSDEEP

1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888Z:9QWpze+eO8888888888888888888888A

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4337) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\am.pak.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	e6864330dd4a1578af1b7cba23e1afa0N.exe

C:\Users\Admin\AppData\Local\Temp\e6864330dd4a1578af1b7cba23e1afa0N.exe
"C:\Users\Admin\AppData\Local\Temp\e6864330dd4a1578af1b7cba23e1afa0N.exe"
1⤵
- Drops file in Program Files directory
PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
89KB

MD5
e29a7eca49255952b0ded61281e0c283

SHA1
c45b99ba216dd59f91155f6ac15903a358c7259d

SHA256
4639c0d80bc4582d5313c81436a84325efa0f4d376dcf3378eb7d197863ef711

SHA512
05b46527946b2dccff346ac4ada4fb29d6cac2308ab472bcd9537b8a0152f5f0f1b1da138ceba832c6230a2d3eac7aff3fa26f4a8a10e8065a0ecd5ea25c4b23

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
a2ffb2184da4273add40df9d3f63ed36

SHA1
c0809f85cd88558a1bf14f7626f9b8a74f72b850

SHA256
c73fb4523aed7cbe08b1565b0c0ae4e03edc9377c13bd4296617748b6cf59793

SHA512
2acd02e232ac90c415da5962819f882af88aa1b2ba1c4568cc0caf7860220fb70d3435bcd23c43bc5f57883dcdb8b0104e79ec570157d9da213d57dd7fb6d95a

Download Submit
memory/3680-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3680-1788-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads