dae67cc14c1fb94b511513320641a9a52d7a189e7b82298a6705613ab220ec2b

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a00b6d3f62dd2bb1a29d0b87e9806830N.exe
Size

32KB
MD5

a00b6d3f62dd2bb1a29d0b87e9806830
SHA1

13aaa70244f8f9a2a08c6b0114bb6df56a455944
SHA256

dae67cc14c1fb94b511513320641a9a52d7a189e7b82298a6705613ab220ec2b
SHA512

7b572b826a5faa3181ebbd7a79a132286962e604aaff77383e700e936ef6ecb3f8ede50440dc612b0b57d3a8892b3d96ab7d64d11274d658211d81e319c1c98d
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhvYYjYHUyYCyYBYU/:W7BlpppARFbhjbhQYjY0yYCyYBY0

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4366) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\bg.pak.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\uk.pak.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	a00b6d3f62dd2bb1a29d0b87e9806830N.exe

C:\Users\Admin\AppData\Local\Temp\a00b6d3f62dd2bb1a29d0b87e9806830N.exe
"C:\Users\Admin\AppData\Local\Temp\a00b6d3f62dd2bb1a29d0b87e9806830N.exe"
1⤵
- Drops file in Program Files directory
PID:3252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
32KB

MD5
a92618fea2db87a316d256c5954ec4d8

SHA1
a9e84c43db1cb245b83cc1821a04c6d2b7fc5b7b

SHA256
0e4abc57c67f4c6f181ada9ed765b808a495a3cc391f52e49942d843bf91080e

SHA512
a411000a8355ccc4f71fb32a222bcf084ea1adcb415dd915c564c016362e17a4f906c162e32d50e5d358c1cb6ac89e0c0a4f4c4be920ddb695b1e4016110d549

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
131KB

MD5
2cd91dbace78d323a08d0e2d8bd2b35b

SHA1
f5e95cf4186c440ae9fe59fb53a2003d6516bbc4

SHA256
bc870b65f6582324a4953aea53598d313291e1d22f452e7de9d8e0b72e91b4bf

SHA512
76098a94ffbac84b7a59b9b3693b55fa77b54464aa0acfe12d8b42195b91948e4602f5f660611ee1765b6c458d34529495f2f496c4639dc14599824a4ce3a580

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads