Analysis
-
max time kernel
144s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 18:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf25e5585e905910ee8d5d500b9aec5a.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf25e5585e905910ee8d5d500b9aec5a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bf25e5585e905910ee8d5d500b9aec5a.exe
-
Size
55KB
-
MD5
bf25e5585e905910ee8d5d500b9aec5a
-
SHA1
2676411c2d8df826b4d8af7b6856363cff8741d5
-
SHA256
3e70903ac77e590bd7d9ee8fcab752c2088370907859e9ba8239786fc8ada313
-
SHA512
20ab5c923e72324a9aa50aa205684bbf370218d6899d1f3a0e85993a8cbef4aa770ef48e0092353ea0697e2c19ca91207145d883364b60d097bfeef2015e0e63
-
SSDEEP
768:W7BlphA7pARFbhOm0CAbLg99gwVHyVnSQTQbzjrY/+TQbzjrY/Rc3Sox/6Sox/C:W7ZhA7pApH1IwVHykEE8
Score
9/10
Malware Config
Signatures
-
Renames multiple (463) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-file-l2-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-memory-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\ClearResume.aiff.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-heap-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Security.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.DiagnosticSource.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Process.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Extensions.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\desktop.ini.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp bf25e5585e905910ee8d5d500b9aec5a.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp bf25e5585e905910ee8d5d500b9aec5a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD53724239f13a6e2669f02b3b72e4ba043
SHA11b395aec1268b7ff3e721f29ffbb31338be8f54b
SHA256b7c8d9d3766275b3bd6ad2f4065546a5c4a8a7990a83d12a597a806bff95bffb
SHA512683535a41c02e200d3edcc971d81ffb353e261d0d908203936fd98c4a83755fbdb0f272da8e35124a2ebf1d56dc1221ee9088bb89485fcae6847c251b390c1b8
-
Filesize
49KB
MD54c43f0523a786232e85918560958c29d
SHA13cc23deeb9815efc61f2185fd4281c46ba10ea87
SHA256495dc04b1bcb5626e33db2c0823b996497287b0dbf3df151ca2f1c2546b3daf5
SHA512616aa22b647950039ebf5b0bbc11379819ed4d89d4dccfa8658cd0f9d4f44c86b6a18d61689533c42b5cd3bd2a94015b150ed28228ce5cffc9af8e700d13ec46