376a50451a5fb7e3cd7df18ae1d0ddda046fe655bb62aa3399fd4c4a43ee9640

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbdddf8339bd49726b905eee83d297d0N.exe
Size

41KB
MD5

bbdddf8339bd49726b905eee83d297d0
SHA1

018d49eed5922caf32b93930bd076e3cae0d1add
SHA256

376a50451a5fb7e3cd7df18ae1d0ddda046fe655bb62aa3399fd4c4a43ee9640
SHA512

8b2172391263c67bd267f8c9b97fa9ba543ddeabbac3c699b215dff47cd98f03961d8d75556d21522a520b3b25177ec3cd19601da1163f503cfbebfd6ea652c9
SSDEEP

768:W7BlphA7pARFbhOm0CAbLg++PJHJzIWD+6/huEQhuEs:W7ZhA7pApH1++PJHJX18EQ8Es

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\te.pak.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxil.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\zh-CN.pak.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	bbdddf8339bd49726b905eee83d297d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	bbdddf8339bd49726b905eee83d297d0N.exe

C:\Users\Admin\AppData\Local\Temp\bbdddf8339bd49726b905eee83d297d0N.exe
"C:\Users\Admin\AppData\Local\Temp\bbdddf8339bd49726b905eee83d297d0N.exe"
1⤵
- Drops file in Program Files directory
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
42KB

MD5
b93b43a2f983235edbe6d932c072c625

SHA1
33f78decec699215a8cdae6b4b1711d59d8c4f69

SHA256
9d5d43e123cec43ec82b3563d60f96555c6d174dfc2c8a932605c7d366f723ce

SHA512
392c63eb6e78912b884cead62bd0f485aacb7b5489bd0b45125f32666dcadeb10ee0b649be9f88de439b4c04d5c62bf525b0e61d4a42a7b1c131751d2d26ee4d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
2c01a0cad4f76f51bb9d801272ed4dc2

SHA1
78512e41e60779a92460b69bd1b24a2c8f13e40f

SHA256
6b65d256702d7c7f3216db51b0a814b5c07e5e437a37d81933d0e882bf6938bd

SHA512
0a52c40c0a2b7142f5d75949bf801e380e0e22bf8c15ab04f21a66dc39a93820fc6dead1e419c3225ee76087000e824b5ee6ee5e8e43299f1530327c3ccdc9cb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads