e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
Size

51KB
MD5

16bff1c1229502626025b460b12b84c4
SHA1

e27ac39a0dd95634c869e2cecf48941742aa1f12
SHA256

e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8
SHA512

f9a67abf0febad27cc42318ebe402b593dd25788df9e4c010fc89e33a449de3a1bddcc4c01533ff5f2e3a89cbe0614dcfb3f621cf2a0aeeb9cf7bc3d9d6e05ec
SSDEEP

768:W7BlpppARFbhbt7Y7zPhwyPhwdOwOWF/MF/b3:W7ZppApIayan2T3

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4892) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe

C:\Users\Admin\AppData\Local\Temp\e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe
"C:\Users\Admin\AppData\Local\Temp\e5bc3479b6042f703eacce18c9480dd8d47b4fddb04981d25ec938753b7f7bb8.exe"
1⤵
- Drops file in Program Files directory
PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
51KB

MD5
a19246993d7a4677f7d0ba9cd2efba0b

SHA1
c6269991093fd2771b453b328a8d742efa5339f0

SHA256
396d3f7aca54d7d6379e22a5c89cf2103779157a75f34862f9663932472c50ca

SHA512
5c0cbb6b27fb8b9598ddd336e56fcea1d27d54030456fa905d5bc6fbe21de9e9ac896cc7dc0cfb63bb636455d47c6d56e51e6a7edee2aafe479ae61e07d51ef1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
150KB

MD5
dcee07d3760e293eacd69175ab9d9850

SHA1
8460d2993e533b29b11946f8b43d76918a86be0e

SHA256
3ae4f8d8bdeac73a2be6be38890852bbe0e80217adfd3127f865f5ed12694f8c

SHA512
b61e70307a1d640dfedaf3817e929d6291eb0225db0763e09180441eedd4581c208e99b412e1228398082d4a6dda625c082edbd0a0c53d11c3909fa20007d0c7

Download Submit