Analysis
- max time kernel
150s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 23:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe
- Size 68KB
- Sample240530-3s86jsfg76
- SHA256 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d
- MD5 afceac8d26c398b96ee14f489a653d4f
- SHA1 c8fb7fd4ab901e370713b900f4cbdfcad22cfe13
- SHA512 501acc2e5a6c7e79938533f4321a1a0aeb766079eff2889768e668c102417756c2d24f96d1440db7ecc4edfc3659aca59b672704baa75e37b848d87b3b8f4233
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhW:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsP
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_elf.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\gu.pak.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\7-Zip\7z.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp 7e67794ec5979b6ad9b364d0f28472b1e54f61e505803c2e210e2107749e5e3d.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 69KB
- SHA256 0be57e18102568b1a8c8b687feaf78d0be933833a48fb8de9726a1787dc6d33e
- MD5 f54569186bc0b1133a5fc03213032ccd
- SHA1 c01429128d9b3cb6180450dc45cfb6250a7ddea2
- SHA512 b88555a9d4b8353af77092e06656fb782b5770968bdcd7be25db7d77dbc7f9890fda222e3f4df39ff976ab659b89ca895526fe5325b8d4b8e6989d23983d7526
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhd:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 034cd35a03252f9488274846eb38a618a1049bb19409ac8ba3c639e34a0294f8
- MD5 786cdbaceedba2261c7607448459fbd9
- SHA1 9d95b8452fdf9a3d30119f06af217daac1315d40
- SHA512 de9adef948bd545e046714dafb6d7fe88fd7c165fa03a8bb6a6b1e6d317fba4c4bc1131d04fe1fbf6d91c99da4924bb2976798e261e268482cb8b98fda747351
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBd:PqFF2Ie+efRIjNDv0bNXkbvL3
- MD5 SHA1 SHA512 SSDEEP