Analysis
- max time kernel
5s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c42963f61db5cd749b3c8f959050116.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c42963f61db5cd749b3c8f959050116.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 9c42963f61db5cd749b3c8f959050116.exe
- Size 221KB
- Sample240107-y6fzpsegb8
- SHA256 c2d7486e9629af0c2a0cd5846e0e4fe82b90f3cc2c4b2739cfb1fee72a1216d6
- MD5 9c42963f61db5cd749b3c8f959050116
- SHA1 ff0c3128c246dd9a97d867153569a5dd3e4c467d
- SHA512 73d973876ce3b6cb5ef8853002f8831d7b7aea642a4f40559cd2c2765f45cab3c26fc29d85e1fbf779e658cb6b33ef388828be7a23dc98838bef2d17f7bdb597
- SSDEEP 3072:6QWp2yE1u1duPicoAfnk/MPCumdoFynbaqcr6fNO6pqpXQNDagaGgGwjmh6H98FW:W0yE1u1duPRvlZmdoFynbac4mh6H98FW
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\readme.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\7z.exe.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\7z.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 9c42963f61db5cd749b3c8f959050116.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini.tmp
- Size 221KB
- SHA256 d50c090e50cd27f97f1367b6ebd80c4b3ec61786e970d0b6e507ba3ec0021716
- MD5 498370e7c2023ef41f38d6bdf05ef1c9
- SHA1 92619fd7f1d341d89bc14fb6eec83e6872ee6aa1
- SHA512 9038dbe7c9e1bbe5e7ce53cb1e564c61e418088e2ba4c30ee1576d1e0f7b9f98a98e561554d25f89376f1f5a47b5c30ec22c003374b20031380df3a3146e57fb
- SSDEEP 3072:6QWp2yE1u1duPicoAfnk/MPCumdoFynbaqcr6fNO6pqpXQNDagaGgGwjmh6H98Fx:W0yE1u1duPRvlZmdoFynbac4mh6H98Fx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt\config.xml.tmp
- Size 222KB
- SHA256 aab2e80049461c537a043d73d3d25edc15991610098a6453f9b06dd4733008a1
- MD5 76c26957f3f280510297c37a6c8e7405
- SHA1 58e87688422c06226f0cad81e00c08b220a71338
- SHA512 dbb995f27848db2973e6df5777fcdc9afb778778c435724b465ea2d326ae327ed02864b8adaa8d825a6a20a49806fd8fc18b32abcc45d12f28b36170858ea425
- SSDEEP 3072:6QWp2yE1u1duPicoAfnk/MPCumdoFynbaqcr6fNO6pqpXQNDagaGgGwjmh6H98Fs:W0yE1u1duPRvlZmdoFynbac4mh6H98Fs
- MD5 SHA1 SHA512 SSDEEP