Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 19:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe
- Size 72KB
- Sample240601-x9fyfadd89
- SHA256 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a
- MD5 0f68fe6575be752e36c2ac8f3fa84c7d
- SHA1 d2e68f39f161c2097073e5e8ede8c3c935f74853
- SHA512 d9eed6ed84b81f27d8cdd644e54e44d8ba07a84315acb8d445ba90d4536120aa9bdf25882de1f4b0e6718920cba5331a9ffb3888fc608090b0cd2705b86a0c5d
- SSDEEP 768:W7BlpNLpARFbhblkYlkuvIYFKKXPXnPoKXPXnPqr07SeG4vPEL30iX0qYHiugAKd:W7ZNLpApCZuvIYGrgfGqcLLiHiZd
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5008) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 25d3d2c98d68478110f6f0c5ac5381417e247db18d07042e77842e7ea200f87a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
- Size 72KB
- SHA256 b3456cbc92e75c0884d01d685aa1f0834ec42a765a71f075270a40485b4ffbc3
- MD5 9d698915834fece3e9b51342d247ba7e
- SHA1 37cea98c53296a06df44abc7ea24d2b4cb4a9726
- SHA512 c6d210fd0921d367b4784aff8a157fa05df62fee934ef00a2c208639b02b52a47a75e43a03d5789191c4de4bced45eea049f7b034c34fd1be450950d3a76141b
- SSDEEP 768:W7BlpNLpARFbhblkYlkuvIYFKKXPXnPoKXPXnPqr07SeG4vPEL30iX0qYHiugAKW:W7ZNLpApCZuvIYGrgfGqcLLiHiZW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 171KB
- SHA256 0f9f4a5ad3a0f48b52b65e31557278372b781e58f4afe23be156085f7522a9c0
- MD5 e903dcda114f2dea627be08e1bfbcf76
- SHA1 1a3c758f74e988e14f9a5157f35e01ade4f4cbf0
- SHA512 35f564377241f1986c41ed837815229b85f4b348ae2a8e554995278c07e54c203fe1f946c2bf5e447fb085448ef7a5b322cc271b61b2e685315667bbcd92cc82
- SSDEEP 3072:6NLWpCZLYG8fGLiHtWHIjN3tj6qnv0b2UrXkbvL2:u6SYzVKIjNDv0bNXkbvL2
- MD5 SHA1 SHA512 SSDEEP