Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
01/05/2024, 23:20
Behavioral task
behavioral1
Sample
7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe
- Size 123KB
- Sample240501-3bq9eaaa7w
- SHA256 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56
- MD5 55e6fdc1550a8fdbb336c5f6c8700156
- SHA1 9dbf831c03300b6beefe2effdd2c9d7faf92ec57
- SHA512 a6065c0b971bfd3ee558856d5a40d0c23f8dc3f22bff6ca974369f506056d6b0a82294a483e770c2948264d9d85d04c82b6ca2509b1851ed8a4a86d70997d287
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCL:fnymCAIuZAIuYSMjoqtMHfhfG
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/2112-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000c000000023b79-2.dat UPX behavioral2/files/0x0009000000022970-6.dat UPX behavioral2/memory/2112-1678-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2112-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b79-2.dat upx behavioral2/files/0x0009000000022970-6.dat upx behavioral2/memory/2112-1678-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fr.pak.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\7-Zip\readme.txt.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp 7582fe7063eaafb4a3e30592318b09ab000578f0f4013dff62a660bcdce47e56.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp
- Size 123KB
- SHA256 972a906591e948894cf611d4f6fc117565a893616a1cd895d473942fcb25c40c
- MD5 cf183fc20b1e73d34122959636b27ddf
- SHA1 734c0a233268f38bf9996f33c9f5e17e65143f2a
- SHA512 089c65481aca815d6bb85d481c039c40e62dbe1c6e99c739200af22e37ee577158d3445d86582224165eb74d37dfad619870d1a4cd2ee4435f94a12611706155
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCN:fnymCAIuZAIuYSMjoqtMHfhfE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 222KB
- SHA256 914efd8741396fb00e33c83b04baa56267c6bfeac7f1655311a5a7e091bf4106
- MD5 051936f333c03a99ee209b8e2a5667ba
- SHA1 a560be5ec23ec3f42ed757d3ba3b27571f01defa
- SHA512 69a424def1e21835eadacdd7c6a302cfc39f5e7636d68345ec21366a681546d9a01bc65faf16f38e65e8387474f77b3087ecd0d06b5b40783bca06729c72bd0c
- SSDEEP 3072:fnymCAIuZAIuYSMjoqtMHfhf0WHIjN3tj6qnv0b2UrXkbvLo:KmCAIuZAIuDMVtM/RIjNDv0bNXkbvLo
- MD5 SHA1 SHA512 SSDEEP