Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe
- Size 83KB
- Sample240601-16cndshc29
- SHA256 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884
- MD5 694edca3cc0350ec5a67489d455afef4
- SHA1 f0b0523a74eb3234d36e5d97fcc4175bf829dd40
- SHA512 a70a2585e501a447dc86ad85f462874729e0e11dee2788b819f7367600bd89160cd2891c5bdb0b3538aea589935a13b7ed214309439c457b1a102eab24d23cf0
- SSDEEP 192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7Glv2h+H2h+0/kK/kfY:GBt7Br5xjL9AgA71FbhvoBl0+c+9Y
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es-419.pak.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp 63f1f0a15deffe4459ba9200b939eb74496bcaf575c81faa537ccd35e9977884.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp
- Size 83KB
- SHA256 458a10f9a9737146fac08b99d89549f113daacf2296541f1843aaf34bec3923c
- MD5 988ee5d9aa0244825353ba4550e71d3f
- SHA1 bde4f3c512d69058a6416a645d34d41164650eef
- SHA512 eb43d10f07b52576180d39ada1f66aadd7b7cc2cce8e03f18e8b350ad25315093dc2dd190f911bd9687e5b0acc6cb82050d4572f4e665f550a206c0dcbcef730
- SSDEEP 192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7Glv2h+H2h+0/kK/kfq:GBt7Br5xjL9AgA71FbhvoBl0+c+9q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 182KB
- SHA256 92d01422efde50c2683a363acb0c4271d92244ad7a7c1375931cc809c230ad5c
- MD5 a1f186ef947f5825e849ff347255fdea
- SHA1 8cdfa3dab58fa3b80477d42a93799be1b145d03b
- SHA512 6dda0daefbb574a1d5da929f2531b73c5e407892d037c822aed2363d71498ebbf2ae9d95fc193bfff1785a944043785deeed65f258ccc07e5867af3c554c6b86
- SSDEEP 1536:W7ZppApc4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddg:6pWpPWHIjN3tj6qnv0b2UrXkbvLC
- MD5 SHA1 SHA512 SSDEEP