Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe
-
Size
80KB
-
MD5
54cdcb1a6bfa51cd686b1ba27efc1961
-
SHA1
875864b5a8b22c4b64a9155f8c4319bdb1ed99f0
-
SHA256
68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407
-
SHA512
0ca2193ee9fa234c8636a9c867c26d110dcdae38c87ad9a6d77a3067e9b8c20eb8a8fcd8ac102a407b451fafa1500e615b74d3a1df752409a8ec91f704848e78
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/a:6e7WpMaxeb0CYJ97lEYNR73e+eKZa
Score
9/10
Malware Config
Signatures
-
Renames multiple (5177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp 68167d81fbe0c12ffc0e16698b86fe76457c3a576272b4f1c0b06afcc5653407.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5bb5d0d2217a4b6208bf92a6bebd435ba
SHA1dc774966dbef27ff4b85a43670cdfd7569474b14
SHA256e1c38af2f8850eb50d79677628b42342df0223b7e2f4915c8c39988d30d87559
SHA5126ad18afca4e3d5aa8bf87b8619c2a91ae32b565e34e1d38cf2a8ee4dab83647d6ea8047840ecde3f7fda27b11139362df97c4086dd6a7eeb1aa25f0c0fe30b3d
-
Filesize
179KB
MD5317d9faebb48835435be501f0e8d7767
SHA14b4137cfde2c209c5dc095081c820cc61e6e5941
SHA2563c710c9ccc8c8e37adec8795bcb69d70097240eabed191a6881c1e475d48e449
SHA5122ed4224156617128f4f7c54c2144152f69b30654ed7f4237f05be3089860007065678a17070b3d74be6ceaeff696b698443b39042bb31add54134a455e1c13d2