586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1

Analysis

max time kernel
149s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
Size

49KB
MD5

cc7b1eae6e74932a76ec96a167aae73d
SHA1

c5d8f8911822fe265f7a6f9766d606935f612561
SHA256

586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1
SHA512

79c1b961827c1e5329d175923e835064e1e16405ee89f5eb4a87ab8b1c9888d3efdec1ea4ebc3263c6d386bcdf8327fc59da540fd0917c59b8e53f4bfacfe073
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNKVkVYlIAItCXYh8YhZ:W7BlpppARFbhFAxCIh/hZ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe

C:\Users\Admin\AppData\Local\Temp\586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe
"C:\Users\Admin\AppData\Local\Temp\586bf4c787e23d2674841230e33f54d46ea51b41183e04a0ed88eef025ee9db1.exe"
1⤵
- Drops file in Program Files directory
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
50KB

MD5
23f1f59474f6328c07cfd4667aa8cfda

SHA1
4ac4a88ab253e7b594f9e6a8c7f5eb563e3e7501

SHA256
85c08be2add4a1a7fb5f323bb7eed08db03303fc28dc8fcea63f388f6c8f38cb

SHA512
046a566f47111265ca32fb6aebcb8d33513f03143aa9a660967ae5fe1623c71b2bd96c80d34ebb0a85ad95d465662061c00f0ebf6704ba99cc67b89586e6d7ff

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
ff827e1c75d237fb3a41bd10f26a6592

SHA1
39c5cfde0aae8f1922920375a41991b363100e51

SHA256
8d56d1f7978c4c210913b1eb7b0c43ad6a58be180e2d5f2a595eb85bb6d5fd39

SHA512
8ce1f90a1ae874948ed8d80ccc46a2a1d5a058eb53efd7913c18821c576760d7d94635248e4a4efba5011556a67df1d60b2921c3ea4cc421dad16c12693cbc01

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads