Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
- Size 80KB
- Sample240525-dldnmacd3w
- SHA256 c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c
- MD5 22ec8ce09d9e8f76a07a203c3f60e05d
- SHA1 aa90df2eff4a50809f90e39d564ba1779634b70b
- SHA512 d6e42b5b81c83248fc804d5df70ab281ac1a32894908a10ed1438e0921636f0e62558728e56e673dda00a7a93d40551544b3ce90e32dfaebc8b5b3b9a82429a0
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhn:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsa
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4850) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp c4a0b447af8cd5179cbd618dd995feec917bdeef1778192400a76a498413d86c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
- Size 80KB
- SHA256 ae0c5ac1a837191f093bbb0b2689bd4ac36beaa6c34fbc2c495444bfca93d799
- MD5 6ff9888986bf4f205643b88c09838e95
- SHA1 78d9aed54120a5704452adf028a6f4ec478c48dc
- SHA512 a81f89702eb0624af9b1f41543f2b097b4da5bd52d21dfc10a746eab406249edd0eb019b3821102dcad4de67015db67419cded0418783a78ad80a8e9ab184962
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEht:6pWpUFpEhLfyBtPf50FWkFpPDze/qFss
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 179KB
- SHA256 c91a58bcccb99b560320f95b907296e4ca86126966bbaf7a1103d8f496a5d150
- MD5 47f2114dbdff49c5f1f4572f5b2e32fb
- SHA1 baeb15dedb0d24b8de1866b36781c18134ff2a48
- SHA512 35ab379c57755ca6ae9bc37a8bb21d6b2058c345930da3ae6d5c7b62eba9dcd7d976e5dccc77fb55e947f68236f474afc3304ff397b77a31d77f6a7c4cef7c5f
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBb:PqFF2Ie+eFWpbIjNDv0bNXkbvLa
- MD5 SHA1 SHA512 SSDEEP