Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe
- Size 81KB
- Sample240603-ws6bbsed6v
- SHA256 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d
- MD5 2ef2ab49dc9d721686d0235316c05a52
- SHA1 9a13e4e31d492e4102e5495f43803becca725487
- SHA512 8e36bcea2e5a1664e8902ae212d3a58d5a193dc0b2b520d02f79e00a601bf391851d546c28ed28a97269425c4a9c448554b38ea87daafb894ce0742cd0c0a358
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvoBlLLrvCGQXX9vCGQXXX:W7BlpppARFbhmvjC9vjCX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4996) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 035a840954e19f3eb8d3989f6fb7fe35063bb55f87ca3bb6190374f7531d935d.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 82KB
- SHA256 250d6611c47687f143a8bd66796da37c1497da91db7715f09882ae75321c33ba
- MD5 9c2bae57cb0cb7f4c3394e19afa4f7c1
- SHA1 021ce18b4c89c2a4010f47483b2ab7318feb7dae
- SHA512 a2ffc8dc62240018771cc8688814ce862cb0ec1e8874fc439c37595ec663808b31b057b202fbe48b3fcca3fc89e06b255fa2878c5809988319eab1b0aeca2983
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvoBlLLrvCGQXX9vCGQXXb:W7BlpppARFbhmvjC9vjCb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 180KB
- SHA256 664bdd4f52365b76412dc298f814884ba1a64b02556fa2ab0f19609649585a95
- MD5 f7cb8fe64aa6800048ae6bc10e898566
- SHA1 0570f6260069ad0fdff9013ac067cf4ed50ad9bb
- SHA512 1f6ee3eaf9281a1ff0ccfe00b0c412dc6ef6dd91074d6f2737ffa6e6e3a087d76728b1fa896a747203fbb32e20550f4c478578f6d84c5a43b1beffbaf420165c
- SSDEEP 1536:W7ZppApmvgvk4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Di:6pWpKMnWHIjN3tj6qnv0b2UrXkbvLe
- MD5 SHA1 SHA512 SSDEEP