Analysis
- max time kernel
152s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 18:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe
- Size 134KB
- Sample240601-wzag8sbe87
- SHA256 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d
- MD5 1138ccfbf5f699b84018e3752e966631
- SHA1 c50e42a2362e65b0b57cc929623bf7125af12190
- SHA512 16fa26fe6ee3338efe76f84b9dfc872877af43e5b010f6734ac3004757c776088d3af34d47fc07e4401d2a5d22ec95148e2c44f9414ad2006719b0c4dfb75b84
- SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzs:RqlIyFESWu0SWuGSwxz
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (1337) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.DiagnosticSource.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Controls.Ribbon.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Primitives.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationCore.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClient.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.DataContractSerialization.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationCore.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Cng.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Input.Manipulations.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.EventBasedAsync.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationProvider.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.HttpListener.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Input.Manipulations.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.RegularExpressions.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationTypes.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Xaml.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Design.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationFramework.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-string-l1-1-0.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationClientSideProviders.resources.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.TextWriterTraceListener.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.AccessControl.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.AccessControl.dll.tmp 06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe"C:\Users\Admin\AppData\Local\Temp\06632befb188e4e73fcd2c02e1aff892efe3ba309bfc2bd138dc747553dc2c6d.exe"1⤵
- Drops file in Program Files directory
PID:652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:1708
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
- Size 134KB
- SHA256 829d24db6815984006d265247d47c1c984d79baa05c8c81fb2586149cd366d9f
- MD5 cc65ab8a88c57d387ec9dae15cb46662
- SHA1 edfdcf0c267b544cbfcb26cfff80425893209a8f
- SHA512 34656ebfb3927c35bfdb77d4023a2c0d44077ecae71f71c69e670994424d7eacc5a9277e97e3961ba0c0f862bc7b89dee75eabfafa12b469c1ef962473d1dc95
- SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz5:RqlIyFESWu0SWuGSwxe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\libsmartscreen.dll.tmp
- Size 134KB
- SHA256 30b329d6b65ad99a7bd87262bd0fd27884b64519b42a844e119bf2e7c0b2c587
- MD5 2abfe18ec54eb80b2851daeeec938a23
- SHA1 00989194a469f2a5e1b344869f3b1bf65efd5e38
- SHA512 179f2c559013a5bf38f0c0b2772f235fcb5359421ec4d05cfb65c01de4327776ae37a795daf67d8c4f5118d0082ddf9e2cf61b112f1736dc588f54fb2c57b556
- SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzu:RqlIyFESWu0SWuGSwxB
- MD5 SHA1 SHA512 SSDEEP