Analysis
- max time kernel
150s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 22:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe
- Size 69KB
- Sample240601-2lf1rahc61
- SHA256 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2
- MD5 4dceee83571f75216bcaa4d075762220
- SHA1 9afce283b78226498c2d5e607330898ca6ac76f2
- SHA512 4adaeb416780f41933fcb1fae3bac846ae31ebb0c348a85b6e72d9b0668a95c7ad7f8dbfe3663ffec6fd89f750ecfec65ec52ea724a7e50202b0707be4a77db6
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyu+fFpsJcFfFpsJcWR5R5vo:W7ZDpApYbWjIlE77u+fFpsJOfFpsJpT2
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jre-1.8\release.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 6c22c49b2ac39f42e2a709b0ae8c0f2731c6b0b8a1a4057775eb7a6fb67bebc2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 69KB
- SHA256 c22ea8b7e061ab70818edb6b7af4239955a3f373a1993e23c77d5f3f18a3f6be
- MD5 0c9dc9f57e45f24752089b332cee4c47
- SHA1 06ae69a83ff73d2fbd0355e5e5ecae8fcb2a44b1
- SHA512 8864af4f4aa23f7300685e1840c5c07e60a6a79f2564d5a9d69f855bb8bdcbed4887d8aa30dd6c652b7e21385bcd0d137c0f10610405258a7966d98396289f53
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyu+fFpsJcFfFpsJcWR5R5vl:W7ZDpApYbWjIlE77u+fFpsJOfFpsJpTP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 168KB
- SHA256 06ea902294fbf34690566c551bf458e68664edc01d3d0bf5653682d26f5393c2
- MD5 ef388b4d37b38b2101623ad4b8df73ca
- SHA1 1c04b416850582ab2ea55741454996a744b6b930
- SHA512 009ebef26d2d17c0f341653692c512d0042a6addb805dc39f10a1240f411fa5a9e9e3461776faa1e2bb81c57d2fce0b976fb5ef2d29cc424169ffe0323cb4af4
- SSDEEP 3072:6DWpwE75fFpsJOfFpsJcWHIjN3tj6qnv0b2UrXkbvLa:dNsIjNDv0bNXkbvLa
- MD5 SHA1 SHA512 SSDEEP