Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe
- Size 38KB
- Sample240601-2cc8hahe65
- SHA256 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257
- MD5 10423c481b7614b62c0fc08e6357fc7c
- SHA1 98d78ee7aed072d882c1ec1d25af9813a5d7ba96
- SHA512 1f0046ce989bf9345e3b9c6b7b2645c0507bc84dc616318c0914431bdbc05980e7b013e1cf44eab85785d75e699767b875b9aed2e85e491d91ad5049c4763049
- SSDEEP 192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vh7m/FJHo7m/FJH8wToio8:yBs7Br5xjL8AgA71FbhvhwMF8
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5049) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\7-Zip\readme.txt.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp 67ab73ff02ff805de1c4758f29cdfae00c9e4d5c89628aceafd841e75e06f257.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 38KB
- SHA256 d82149df068dccac725747956036f937f6f4f56fe13a49ecce59faa56bc11cfc
- MD5 a60ab6859f3eb6170a8a23720b46aafd
- SHA1 55bb8278b41acf44a7ee824b0b4d88714f3dec5c
- SHA512 fe3f3529067f1c40cde7060268fb4849ba8fb327726a4842ef221f760897b2424186eaef4d7a00b6d7accd76df76a3ba2f294337c555f94efa86a5bc02a14c83
- SSDEEP 192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vh7m/FJHo7m/FJH8wToio7:yBs7Br5xjL8AgA71FbhvhwMF7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 137KB
- SHA256 b553b6300cd5b646fc56dc3259e9f4300911d26f7134886cadca0055f1904b5c
- MD5 4cd47ea0eb920315d83e6466cd2d1a23
- SHA1 d36ae2ccc821e8aea65220f31df037068731f346
- SHA512 33290df2ca7176133b03ff8ea69181028365acf80e97644abefec58997a5a48ebef897231f6ddd8827c9cda5e5502ef94733a578408e6a10c4672e95ad44957d
- SSDEEP 1536:/7ZQpApI4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DdX:9QWpjWHIjN3tj6qnv0b2UrXkbvLZ
- MD5 SHA1 SHA512 SSDEEP