Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 09:28
Behavioral task
behavioral1
Sample
f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe
- Size 45KB
- Sample240607-lfp4gafc78
- SHA256 f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4
- MD5 fa247ff707756df4393b07e0d376e6eb
- SHA1 375cddf975df1b336a53ad6a33b2683961123393
- SHA512 5ce42c99f25e85920ab151aa803766de3b4df004e312748d32bcf892cfa2476b73b39e283a420a65ee74533a6e9b292bb43940e7a92bad0de6ff6af2332f6653
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzR:CTWn1++PJHJXA/OsIZfzc3/Q8zxz
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/2996-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000500000002328f-2.dat UPX behavioral2/files/0x0008000000022970-6.dat UPX behavioral2/memory/2996-1216-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2996-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000500000002328f-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/2996-1216-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\JPEGIM32.FLT.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp f910836db9888e444c1d7cdc029f2531b9a8beef21bf8ecd8fd3fb3a4a8097a4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 46KB
- SHA256 251a1817609fb47f10566e1f8bcb0680532f2fdedabbdce82e21df9a6ef32f0a
- MD5 9102ffdd120f1c16ef185abc0b7ac4b1
- SHA1 d131856daac29a4502b70a0853c5bfad87d651eb
- SHA512 d91b1b2f9811d8ef994a9ec2bb399adf5fe62df697804a232722aa88d3564133541e1e2e2109796cf4a06d36b88d9c48f2abe6433b172b448b67a71e87b0f26b
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzb:CTWn1++PJHJXA/OsIZfzc3/Q8zxh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 144KB
- SHA256 f31c71dc24eac53e5e9bd28cb303936407bbc3414f3a589f0fa5500a64a9531c
- MD5 19f15e49339dade93f5d0c8d833fec49
- SHA1 c987cc5aba8b815687a967d14b3967bb84e1bf6d
- SHA512 bd8e9a0f63318be8cba662802cc703dc40bf2e4c9af0122329a8ee86b89e4fc5f4aa7ad6e74bfb5becb151c434cc0b8d1da87a769617bea2083945886aae6843
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxR4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0y:KQSoXWHIjN3tj6qnv0b2UrXkbvLF
- MD5 SHA1 SHA512 SSDEEP