Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 04:02
Behavioral task
behavioral1
Sample
b9e7395823b4fba1a5df241416ca2620.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9e7395823b4fba1a5df241416ca2620.exe
Resource
win10v2004-20240226-en
General
-
Target
b9e7395823b4fba1a5df241416ca2620.exe
-
Size
80KB
-
MD5
b9e7395823b4fba1a5df241416ca2620
-
SHA1
0c3eba96466523d1198b0eacbba9aa578321a791
-
SHA256
d5d2b5b9b359f71c3b36d48da613b35d5550fe7df0a08f99367fe7a2e4c0c149
-
SHA512
718d32ecf6217ea1bec96cee232700e80fa4b5d2cb45fa8b25d99198f463d92ef9fd27bb2bb05d6c3aace86e1032dfe73e50b01b4a483432ebd49aa4d10d134c
-
SSDEEP
1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxkqGUBM+PocOQOFPdMRAHAASnnD5D5K:+nyiQSojUBM+PocOQOFPdMRAHAASnnDa
Malware Config
Signatures
-
Renames multiple (1394) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1368-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023245-2.dat upx behavioral2/files/0x000400000001d8b2-6.dat upx behavioral2/memory/1368-396-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationFramework.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Configuration.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Controls.Ribbon.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemCore.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Requests.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Overlapped.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\WindowsBase.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebSockets.Client.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.SecureString.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.DirectoryServices.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Windows.Forms.Design.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Intrinsics.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClient.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Cng.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Primitives.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.SecureString.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationProvider.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.AccessControl.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorrc.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationFramework.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsBase.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsBase.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\ReachFramework.resources.dll.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp b9e7395823b4fba1a5df241416ca2620.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp b9e7395823b4fba1a5df241416ca2620.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9e7395823b4fba1a5df241416ca2620.exe"C:\Users\Admin\AppData\Local\Temp\b9e7395823b4fba1a5df241416ca2620.exe"1⤵
- Drops file in Program Files directory
PID:1368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:5000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD51d4cf1ccd946c7634f4c540fcc8d2459
SHA1fa9cbd7ab7b7cc2d61b54764931d70baab67ece4
SHA256fce4f98975d17426b95637b83c2e049bbebf8b71b10b9d40fdaf284ab4cc850f
SHA512522281a1a8d8fa00865848b8c6aedb38125134f362ae146e3f01fb64301e333ee112402656e7eedd7c068fcc823f16a4d511a762d1065ff6b73bbca3e99f6ed5
-
Filesize
80KB
MD5e5c5d7303e4d682b6e723a6a556bed36
SHA1df00686c728952f8643d89401eaa4ef8f8a42cc4
SHA25672c18d0670ea6c7eb6c6c906037487d2e4e020fea95f8aa2a689ea7ba378704d
SHA512c467047651c4e9e5a4526a21fb61af2efd3712b73de85b1bf01a84308b044fe9a71acdebbbb01d157b62f19cc261f45bea8ba5c4715a23c430cc8109df866ae9