715a497e37b9e3a40bfe838a0cb6679da87b2d09bbbcaf51b4620c66ac3163d0

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c18371f2bb08464bf4e27a734c5e6db0N.exe
Size

52KB
MD5

c18371f2bb08464bf4e27a734c5e6db0
SHA1

9ee8ae37a7007e6cc7c278e567256e15c58da4b9
SHA256

715a497e37b9e3a40bfe838a0cb6679da87b2d09bbbcaf51b4620c66ac3163d0
SHA512

519fa59f42dcab1ca2ad886fd22f4f4760dace2dcc33e279e733abd796f496da4cdaa9642f56bc7ef5e5b87ad1237cc0959a5466f3b221be439494d4811fedcf
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBw7:W7ZppApX

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4409) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\ExportPublish.shtml.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	c18371f2bb08464bf4e27a734c5e6db0N.exe

C:\Users\Admin\AppData\Local\Temp\c18371f2bb08464bf4e27a734c5e6db0N.exe
"C:\Users\Admin\AppData\Local\Temp\c18371f2bb08464bf4e27a734c5e6db0N.exe"
1⤵
- Drops file in Program Files directory
PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
52KB

MD5
d41a329cfdc2d3c49ad98a7e399d32d4

SHA1
b763b36598657301aace6681bd74377029898d38

SHA256
cf44f0b38e113416bfbcab2bbd1b58241fedd4cb896d0973e34bde77eefc00e6

SHA512
d3cd3a69b8a6697146d7e260882cf9c79bb85a41513eb691f7c1e099ca46767b092aeba470bf527ddeab3150953721f491327266a1b1ecc4f4312cecc07a5434

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
1ff180a642d006d9727438c388300c91

SHA1
bbc8b53e33f0696899da6e8e176cfd5c70be779c

SHA256
d4258cbea86ae3a59f361be3a3084c8fb5ed6ae07496eddcdc2c3250c60c01b9

SHA512
896fab356720e4ce5ab9ba84cfd72ece2ed4d2b105f72d9709fa7d38ab5f063fd3a6d8e9fd4dc9aa0159b478ebb3eb7b0309ae2748d9a9c5e1144c4394d7117a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads