Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 06:14
Static task
static1
Behavioral task
behavioral1
Sample
e5dc596bd4691282dfd8e1f23e520cdc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e5dc596bd4691282dfd8e1f23e520cdc.exe
Resource
win10v2004-20240412-en
General
-
Target
e5dc596bd4691282dfd8e1f23e520cdc.exe
-
Size
66KB
-
MD5
e5dc596bd4691282dfd8e1f23e520cdc
-
SHA1
10ed5c0fb45e11b9aabf2e57e5a9233c2b7d97b4
-
SHA256
68a710da671a2f84de8b75ccdedffd6abf8cbfd7c92ff6ed60ff9fb8c9850d44
-
SHA512
3fae0c8444a1936a3a924df897a7b0482b51150837360ff2e0876be7080ba44f008504ce33dd908b1447e90c8306a52909fc21ca077dc4143507df55c0ae2df2
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhz:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsy
Malware Config
Signatures
-
Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
e5dc596bd4691282dfd8e1f23e520cdc.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\UCRTBASE.DLL.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\DebugDisable.rmi.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp e5dc596bd4691282dfd8e1f23e520cdc.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5dd72c2dc88f86a995699600712253c13
SHA15776bd3c33933591933cc2dc440ee64f7e58f8a0
SHA256dbe84309d640d9f33a9b7295d4acec5c872bdbebcbf8be98194e3bf1be5f7e68
SHA51231dd83109859860d9da9e7548b374c82cef60c57d5a3fac5b63ba6992194c0295a103674f5aad98127257c3454a6499bf3e58668028023745e048a9e8ade64f1
-
Filesize
165KB
MD502020bdc50d0c3c048a7f4edf2344117
SHA1d7f1f1b52762eba0723396955f5c2eeb03228ede
SHA2566e3086d1065862014baab4345a7ef50a1fd0899e2e3b866a14d0d41591773997
SHA5129a3f415f650fb24b271077e803945941aa4dcd1232dfe2dc3ccd3c557a564164c14a70633b4fe23fb7a2bbbab6605d95cfca517257c0182a623f70aae5c6fbbf