5a46a269d3cebfbe007d622e80333d8f7deda5f1f2bef783e1422a6231d807d1

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9740bdda112a0725947c950e3995bac0N.exe
Size

35KB
MD5

9740bdda112a0725947c950e3995bac0
SHA1

115356b9ccbdc2503e2cf49f19a5cd947abbb2f1
SHA256

5a46a269d3cebfbe007d622e80333d8f7deda5f1f2bef783e1422a6231d807d1
SHA512

d60513fe7afbc9dbdd6e5f8fed254189841ac5f62b83b0359577d2f4828639fe5a5aa17cc242bb422c6128016a88dae2131316df25d2a6e02cb0529157721cc4
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxje6OMmy6OMmv:yBs7Br5xjL8AgA71Fbhv/Fzzwzg

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_wer.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	9740bdda112a0725947c950e3995bac0N.exe

C:\Users\Admin\AppData\Local\Temp\9740bdda112a0725947c950e3995bac0N.exe
"C:\Users\Admin\AppData\Local\Temp\9740bdda112a0725947c950e3995bac0N.exe"
1⤵
- Drops file in Program Files directory
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
35KB

MD5
b34d43e1e1012f74dfcdd727dbbcd9b0

SHA1
fd81e9420049fedf9d66c010671779597bfeea75

SHA256
0d8bcfe6a46bde2753d0134111bca3a238ff45454b83d4998357b44fb56be9db

SHA512
5afaf119e04fc5b7c2b2f3f0a8f5dfb13616a022db7096194c1aacee9471f22f2be23508a26b65596bd891eee9b25819e44a2c97d83109fbfb6823a00fffb37c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
134KB

MD5
67b94855572d2379c19ed744007f2cc6

SHA1
3b6be66e2d893e6a49b24a6014c5f63f9a647f73

SHA256
7dabd2019e557e5daece2fc910a06ca1d9935afd1b0e8b7b4dae5bc56a603366

SHA512
7d0c4fb2625c0e29a8413cc2f88a2a37e3356ac8b90975f9ca9b060c2afb0943619e9d7e15bd25e45a1112e6cb7a7b6dab89b876e70265471d7e5c796ca1bb08

Download Submit
memory/1820-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1820-1756-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads