Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 04:00
Behavioral task
behavioral1
Sample
c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
Resource
win10v2004-20240419-en
General
-
Target
c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
-
Size
96KB
-
MD5
a09d9f23d7cf097cad5a88e8b35af246
-
SHA1
0cb8abbbe2dcea79d915918be3755c1d2581fc77
-
SHA256
c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499
-
SHA512
33a286d0442ee1f0c970b71a784de0f371d2755de7fe6b815be7bf5b22c17316f05254d2e95863938ab72c85454b75e4e360962c306e043caff226d36e4570e1
-
SSDEEP
1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfO:hfAIuZAIuYSMjoqtMHfhfO
Malware Config
Signatures
-
Renames multiple (5021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000c000000023b4c-2.dat UPX behavioral2/files/0x0009000000022970-6.dat UPX behavioral2/memory/4568-806-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b4c-2.dat upx behavioral2/files/0x0009000000022970-6.dat upx behavioral2/memory/4568-806-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lv.pak.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_200_percent.pak.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5252fcdd55716050ba13523d2274f1ad0
SHA103f3808d0e8cf664712b954212e7bbc50561d2e6
SHA25620b0bb877f67941409842f81b40390fa18304cf9a9c4ab10308c12fccf0ab514
SHA51266b8788c2a63c56206c90b6216cf9bc99330e9a65748d96e20a89856808a00db89ce0a86e71845e3ff3dcbda28a1d23d0e9a631c460f84c11249b89eceea93b1
-
Filesize
195KB
MD52d55b110f2615f7477d79e44f98d7c0f
SHA19d9e5fa33a08f727ebcf0e943f0ecd3aa665f060
SHA2566ae5d4b156b2a491dc6eef567b35ee4f2e9d5f9cce9a20f6c6c52beabd605832
SHA51227ed392480711aac6dbc84b4177c681d7e5fe7f1073dec0a4b6f8d56ac00857e12a9e04fdac74a026108de39ab007dc20390222557057e35ed8fbd5b7f1fd412