Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 22:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe
- Size 77KB
- Sample240605-2rygzsbb4s
- SHA256 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7
- MD5 30df3ab48e2b5e5baed66872422b08d6
- SHA1 54d237eaca2351c9203f76460ef0238e36a28209
- SHA512 19d833aac09daffb0450a08ab80e506d944d0591bfc81bc1d56a59abe3d919206c27fbf5c64cd52742fc2032e3480842a7ba7afc084595584a1d072ae984dfeb
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tUyCUyC6y0Wjy0Wt:6e7WpP9oVLQthbYY9oVLQthbUrt7t44o
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hu.pak.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 512ef71cf73de3a78da700de50964d2d31b5c56352fce26256d00d9529a658b7.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 78KB
- SHA256 1158a37a276f4355c4fbf0eea59e15a5bdf9624399a73a44de49aa1a1b7e98d3
- MD5 fa77b8566355d3ec5d804132b1eddb75
- SHA1 9ff8dcbd14fa3f3be2cbde823e2373fcf3a6ace0
- SHA512 a708148c67e75933b4d0cbd50d7d08934833d13a0778d4dfa12e9361e2ac5731148df97ec630284da89932465c87143f8083b8957ca1768038a4318d9f4cb246
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tUyCUyC6y0Wjy0WJ:6e7WpP9oVLQthbYY9oVLQthbUrt7t440
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 176KB
- SHA256 7b3ae72c9dde9dd365f830d8becf2c3c5af3f397c15eea2354007eb45de88093
- MD5 9d3d9d282a2884ea0b57c10ad2d4950d
- SHA1 27b6d2d0df6670e343409d06080d292791ca14c7
- SHA512 2cd0a0521e909467035b01d10a7dda0372d9d6307662d4d07e5dc5bed6ad38365a5977d81919bbb297decb9d4f8f749a129daea1d1da6dea929448af841e48fe
- SSDEEP 3072:6e7WpP9oVLQthbYY9oVLQthbUrt7t44VG5WHIjN3tj6qnv0b2UrXkbvLy:RqAXGuIjNDv0bNXkbvLy
- MD5 SHA1 SHA512 SSDEEP