79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
Size

73KB
MD5

439263cd72bfefd9f01b7cce73b3bb20
SHA1

838df6bf9a987366c98767871cf1c304f7f14280
SHA256

79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4
SHA512

ac141bf95a7156b2b5903ee68b1832760c74b12b030f80af546c205dff3f9f78825fa2a09ea56a2b582aa55a57b81e158d637fde34972f1feb1de590c4a164aa
SSDEEP

1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8Ue+bQ5J:Te76WQSotbS

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\InstallPop.001.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxil.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe

C:\Users\Admin\AppData\Local\Temp\79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe
"C:\Users\Admin\AppData\Local\Temp\79c18e7cae7e93104bc66325b81db6040ba8ac971dc76ee3545728ba6200f8f4.exe"
1⤵
- Drops file in Program Files directory
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini.tmp

Filesize
73KB

MD5
acce528ffb6711f590cb714adb4660e3

SHA1
cd7d4726f8573895535130fac4f7818e4570eb24

SHA256
cdce60297cbf5f3a1fe36f6118ab7a67893c6f9f0ed58f123ecd1442e5976570

SHA512
0efc15741b613b3217ffdfce69c342cb4a8c78b9d475934956a4003d79799c38fd22bff46152baf698e89b035dd46e6bc81705c8d229bd18b0e3844e71a70107

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
be9d4717875ef46e3ddec0e8ab08b61e

SHA1
99aac4271eb910a9d8d1aadc8802245f40514a7e

SHA256
51ef9a8d2b6b4dc0526272d9967759db15f38c3c1ec957fc73f62425e789d9a0

SHA512
7ab814cbb08ada802afcc3962f31729bc8bd1f338482c21b15b3eadb7aeaad685f84d33caa0205c786ffd333e6e031a47258f52af73ad9928cbf634985da96d2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads