Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 04:15
Behavioral task
behavioral1
Sample
e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe
- Size 70KB
- Sample240530-evgmbafb44
- SHA256 e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c
- MD5 f1582db9480b412e8d8c50b8535783d4
- SHA1 7d3f8741fdcefd06d3e68be39ed0361726e40c2b
- SHA512 b488329319ac9c6365372eb5cfbb1c663b63d00bec46bfac6f18ad126e5a9b6da2b8978ee83cf0626776c2e6ee2c3754ac9f11f7c042878ba3d44c5145a6c229
- SSDEEP 768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFmzWzXU4:67Zf/FAxTWY1++PJHJXA/OsIZpPEIUs
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4991) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4628-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0006000000023284-2.dat UPX behavioral2/files/0x000800000002295a-6.dat UPX behavioral2/memory/4628-1780-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4628-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0006000000023284-2.dat upx behavioral2/files/0x000800000002295a-6.dat upx behavioral2/memory/4628-1780-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\7-Zip\readme.txt.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp e3816d0857c5a1e52d9879280e70567eee968ecfc338a87364427f9d5860ea4c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
- Size 70KB
- SHA256 558508d9e9ee31f39534001406b5db59888f7ee09853fff01584e9b7ef7ac079
- MD5 1001693b67360d47c5bffd3c83508d46
- SHA1 b85c2cf25ec8e5cb9f7c931624ad760074c63d3a
- SHA512 e89a909f45c13df95a788b261eadf80210f6bcea68c83d96d3179af812a6467e6e9b5e854dbd7c09e8ce5f33c2e49be62c64763a1b45de3a159480c63baea401
- SSDEEP 768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFmzWzXU3:67Zf/FAxTWY1++PJHJXA/OsIZpPEIUz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 169KB
- SHA256 c2dd45ac662cc3d571c605b1fc66a9c57dd85c14354351a72ad6ddd2632d7831
- MD5 a0f8cfc473794907aa99eabff84546e2
- SHA1 e7011c844f440a2ca222521861ed7df9c43c8c92
- SHA512 af5a2bb8656e3635147c322dd0284d7a5abc68ac9d61fc5554c37de8d895bd7827200f60973cfb1307066b9a1fe271f55e749379523b702a6f5e52355ead3a66
- SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZpPEIUS4pWHlPEXZzjUq3th5f6utM5vLNinVmWv8:+nyizIUBWHIjN3tj6qnv0b2UrXkbvLW
- MD5 SHA1 SHA512 SSDEEP