Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 23:24
Behavioral task
behavioral1
Sample
7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe
- Size 359KB
- Sample240601-3dnajabb73
- SHA256 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3
- MD5 663662ca257f021a14be1f304e41842e
- SHA1 0fbc74d559801f09c1f7bdee91b2fca479e7c033
- SHA512 1c99806f2690d81b2c7cea3a9df3083b95c5dd4f49b79c7e4bf4f7da25ee3fb3b36ba9b29abd4e17b22e8f56b6332d693c6f93aeb4902abae67ddd26743acb1d
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIu4QSo1EZGtKgZGtK/CAIuZAIu+:VQtyZGtKgZGtK/CAIuZAIu4QtyZGtKgf
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3792) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1976-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0008000000022f51-2.dat UPX behavioral2/files/0x0009000000022979-6.dat UPX behavioral2/memory/1976-1348-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/1976-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/1976-1348-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\release.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp 7fd786dbfaa40fb79f01fb6a57c8ac830aa2aa2d133d99efd595daa8884edaa3.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 360KB
- SHA256 7ce51d074f43bb35d1c0c504046c72d1c86182705d854272fcf524d8bfd457f5
- MD5 1ff77bd2bc4a80b7e33dcb0b026fdb5c
- SHA1 db846693557547f228a311a1dfd335a2b7efe433
- SHA512 762184ce13c1b8fe391730bd373700be451f59dd845b6e07ef327483e303744ef9b356353bbc23c141e6f8f33d48c23852ee9733cd4b80d72fd705b67e0c8bbd
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIu4QSo1EZGtKgZGtK/CAIuZAIuD:VQtyZGtKgZGtK/CAIuZAIu4QtyZGtKg6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 458KB
- SHA256 2ae165f0bf1da02131b1232c74495914223bc2c76d1b242956f3332a67ee94c7
- MD5 03abd53e7efeddfcedd6d41af6dd833a
- SHA1 cabcc1b9c79243af90c2364c4416652783006eb8
- SHA512 ddcf8ea2967fbf573e07f1878f3a5df0c82dc058cf92a0545b464c1d41c8299500f12cb22950996d09bc49c683f7d6c143e6b0656f60e73e6b608b6c2c0d060b
- SSDEEP 12288:VQtyZGtKgZGtK/CAIuZAIu4QtyZGtKgZGtK/CAIuZAIuAIZGNXkbvLc:VIthItrIZaXkbvQ
- MD5 SHA1 SHA512 SSDEEP