362b06a8c1cc2736c0ec645fad2f115817b003cfa79dc2ae925cb5be6fdfa82d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7df533a104e32e824a00c94725dfef0N.exe
Size

36KB
MD5

b7df533a104e32e824a00c94725dfef0
SHA1

0e2ebd534653075fe83542aeeaca330d983b01c5
SHA256

362b06a8c1cc2736c0ec645fad2f115817b003cfa79dc2ae925cb5be6fdfa82d
SHA512

3ada72292aecc33722d628a96ef92a1d7dbf5a30ba89473406f13fd101903cd0e89cb9f16281d933efabd44d1d6a8199764c3d7171b662d8ba9645113436a63d
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FdwAHAJOvwAHAJO5zCtAtp:/7BlpQpARFbhjHAJUHAJGZ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4579) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\JoinDismount.ps1xml.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ja.pak.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\BackupRemove.docx.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	b7df533a104e32e824a00c94725dfef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	b7df533a104e32e824a00c94725dfef0N.exe

C:\Users\Admin\AppData\Local\Temp\b7df533a104e32e824a00c94725dfef0N.exe
"C:\Users\Admin\AppData\Local\Temp\b7df533a104e32e824a00c94725dfef0N.exe"
1⤵
- Drops file in Program Files directory
PID:3252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
37KB

MD5
5f82623caf1828ac6a87bf30d1e79a79

SHA1
d38755d2fc72e181001e17202574a72b89d98935

SHA256
9b8354cc6f7ab2fabc004c676dabeee436c43e256b0759c8df6c83db3ab68279

SHA512
e4682909b0d6c65408d0b7fa801d0b93d03d1bc459fb05f8f9e327f13b34f7d61741a3fe36a2926b916e45c8e7f4be7d6e0b26c3c8dc131d19eea805778a22ed

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
135KB

MD5
2652932f549ca9e301ed7cb447eada33

SHA1
02cad234f276a663b6274c23f659200e2394e3ef

SHA256
6299939a0844abdbffa4a5eb19c42cf560079b401e50d5d1f2e7e9a04ab430f7

SHA512
dee826f0ccd586c5c45c46a0c129f2b88c1fa0bbd7e8b88fe3fc0902465916386d02dfb8e41e237bd2e5d0747dcb06fd66cdfc6ed25805be94a01d6f1b0d89c0

Download Submit
memory/3252-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3252-1814-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads