277ad99ee278732db17f4a79156b8870c29b323b16f7a8b846f9513ae597b170

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_94108bf8801a2e696f0439d188c4d560.exe
Size

49KB
MD5

94108bf8801a2e696f0439d188c4d560
SHA1

7c96882806466870a8dae647a146ef0c1c2e27e4
SHA256

277ad99ee278732db17f4a79156b8870c29b323b16f7a8b846f9513ae597b170
SHA512

b47b2dfedea08cc2bc4d9a5ddfd43d4c01fce07e3e9d27c68022cec6f42a1f38c6d4bac10089474045f0b362c3f3737f3a199da7e689b14ff22924e171cc9094
SSDEEP

768:W7BlpNLpARFbhblkYlkuvIYFKKXPXnPoKXPXnPu:W7ZNLpApCZuvIYy

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	virussign.com_94108bf8801a2e696f0439d188c4d560.exe

C:\Users\Admin\AppData\Local\Temp\virussign.com_94108bf8801a2e696f0439d188c4d560.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_94108bf8801a2e696f0439d188c4d560.exe"
1⤵
- Drops file in Program Files directory
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
49KB

MD5
068229309ebd63a6eff13fe4f97b40df

SHA1
aab012ace4a660190401e9d0fc84239451ac08f2

SHA256
656a56809976d990627a2d3530ba224a436b36445a3ddb533eda2b0f39f0d0a4

SHA512
08ee6b0365c8081b0760ececb557e87d8ba9024d8c8e11f056dd6665a9efcc6f1c97a40ee07ccb1ad28541e563f3b2902f0d439ae841763ff38fc8bc58fc972e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
56570e6f62c54532fb57a9041bc102d3

SHA1
b37c9be217b8477c9f642ca4b1cedd0b5d1509d6

SHA256
4b145a0394b2b5f4ac6fe045209e43046b4348c1842be5558c4bc9f2991c5981

SHA512
d1a3dbef609c1bebbb468f3054a6d97e524758b84651860704a59f1fdc235b1ad8f80038c823d3f90e2cda409b9050091761b02dc8a7bc79e31632cab198d239

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads