Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 23:00
Behavioral task
behavioral1
Sample
6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe
- Size 234KB
- Sample240530-2y873aea84
- SHA256 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650
- MD5 09ddcff8da91d311bd47049c1a1a3ecf
- SHA1 1bc94972a30557d5eca619e20d1c2c20bbaba9d9
- SHA512 1f83896cf2d710f2bff4bbe1e224083418532d45f480eb0e498201613356a10809e039a82337d25604a2e00b42ddee6388de8c537093250f6e5f0a78ad778b97
- SSDEEP 3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuYch93g+gfFpsJOfFpsJm:JiQSo1EZGtKgZGtK/CAIuZAIuH36
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4067) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0008000000022f51-2.dat UPX behavioral2/files/0x0009000000022979-6.dat UPX behavioral2/memory/1692-1418-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/1692-1418-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 6b5c17490840f95fe55876b5fa6b18e944e34ef034918a6aded9d9c8855c1650.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 234KB
- SHA256 707fe015a99c6421027e67af4ecc87887157cfd19d4faf72778b96dc5c196173
- MD5 8f8ea3ec589b476c9c9b369fbcaab5c2
- SHA1 efcd3ebf9d30f567f19f378ced324a7fdd4c73c2
- SHA512 de54b010db643b6913cd7c57c7225bda0bf406da9487dc31e581663f1f0de4596d0e2a215d90daf197164eeecab068b59a24454fdeabb66c7a38a2164bd182a4
- SSDEEP 3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuYch93g+gfFpsJOfFpsJR:JiQSo1EZGtKgZGtK/CAIuZAIuH3V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 333KB
- SHA256 53e57ae91cf9036775eca9d51ce655d4c15075eaa62c5224d142c04287f96e28
- MD5 dbd19284aa46fe365f201547feb5aee0
- SHA1 f2acec9eb78bc4eacb9168047e4be87082d96c0e
- SHA512 248a0f73372f8878948b4b7e41d3696970b60a51d7ee14e1072b0fa83fa730a006977bee9fd03ae22d78e134221e999628ad83240c98d67dfd1e72ab0f91c037
- SSDEEP 6144:JiQSo1EZGtKgZGtK/CAIuZAIuH3gIjNDv0bNXkbvLN:AQtyZGtKgZGtK/CAIuZAIuH3gIZGNXk9
- MD5 SHA1 SHA512 SSDEEP