ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
Size

33KB
MD5

a349ffd4a0aa912e105df4c4c14a2689
SHA1

f53353edcc336adcccc6f8b6e1a9d6cdd8f81a06
SHA256

ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d
SHA512

0b103576d2f283ec1dda909bf45d4fb58d41ccb8d18d85ef2cead16fc6b3fbe40d4d4b4b597939ddefac995e3800b672d4beee43d42393389c020d1c3648f0d5
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN2TQ1nr5Ix:W7BlpppARFbhknr5Ix

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\id.pak.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoCanary.png.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe

C:\Users\Admin\AppData\Local\Temp\ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe
"C:\Users\Admin\AppData\Local\Temp\ecd5556dc957c040afd04b7f44d307b18fd7f3a12e62eccc8f9a8e0fb43c619d.exe"
1⤵
- Drops file in Program Files directory
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp
Filesize
34KB

MD5
00333f1bb79e957aac83a87bfe07ee50

SHA1
7a9aa191d7f59fb03b02b57acbbe3cb3fa901929

SHA256
1b2be276908aaffab6f2e3e3829cc4eed0c1d64601310f60577416e13b3b468e

SHA512
d639a741cee5f101c2e9fd29a1ac7aa0e9172c485ae4e45137ff362b621eb418a42c20b11ef1c49901ab4657b1b31b67e1f5a675dd267a6f844b4eca5541fd0e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
132KB

MD5
b4432d5f61cf464bb2a0f1218fb406ff

SHA1
23452b9c6e26c8485f4f62552f0443654f2a2d05

SHA256
0d49974345bd8c992ef822668752746a5be761feced7d1bf28793cad7bd4a7cf

SHA512
757f81b2ec7bae0994be01c4ecf795a551ea908152b91e5fd9c83427ee2aa0dec66d72aaddd469ffe0f2585566068987e9af9e33f9eb5654b76a4fd09d422ea2

Download Submit