Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 11:33
Behavioral task
behavioral1
Sample
virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe
- Size 148KB
- Sample240608-nn88esbb91
- SHA256 9e510c5da144039b537eb495ddff11623b465e74f522aec08ce1693fdb882206
- MD5 d95d47b84a677dad2bf3a8df692878e0
- SHA1 bd5dae0d166f5b9eaf32f7be60a12917b5c4fcf3
- SHA512 efe76eb86ad23973ddf349525b18202294e12cf918fc008124f7c4d31a97de2306d44f81e3612f5936596e209cb96443451d1d8946779bd069caa963741b664c
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC6:fnymCAIuZAIuYSMjoqtMHfhflixi28
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4724) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4728-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023434-2.dat upx behavioral2/files/0x0007000000022983-6.dat upx behavioral2/memory/4728-1682-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\FindImport.xml.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp virussign.com_d95d47b84a677dad2bf3a8df692878e0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
- Size 148KB
- SHA256 67c1a69e070ed4c4e328c217e6c14f41c1ef28492249d2593f10ad0abbb86b37
- MD5 50b3eed6605e564190dd804bb55dc441
- SHA1 54a1fc77e0df035eb794cdb408811b91a3471a06
- SHA512 04b545c4c078c1951a7db9805c0fc7b079d3678e1204ea50f8c2c81ac667f79291a0aeaa43ea06e0dcec272196a35bd32339fa4e6d07ef683c05699bd35f6457
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCc:fnymCAIuZAIuYSMjoqtMHfhflixi26
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 247KB
- SHA256 a79b9e6a345447931be14fe293aff21e838d87775c9e7ff50d1bd3141368a648
- MD5 2ba43174685a2cf1b8053ba42a4aee68
- SHA1 a2bbb10b26c9649e5efea49bf9be974fc72ca3fe
- SHA512 39c5fd21913c05a4d9446e6ca44b0011ecf2b94f9df4e4993140c738aafb3b08ff7b1f4f6eb18165a5a6503e0ab9a539775b7c2c7ef188d7878cb9834df6661f
- SSDEEP 3072:fnymCAIuZAIuYSMjoqtMHfhflixi29WHIjN3tj6qnv0b2UrXkbvLg:KmCAIuZAIuDMVtM/o6IjNDv0bNXkbvLg
- MD5 SHA1 SHA512 SSDEEP