Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 23:21
Behavioral task
behavioral1
Sample
715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
- Size 47KB
- Sample240610-3cbkcavcqf
- SHA256 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299
- MD5 8078c8dcc4d11913c6673a89ad3cd67b
- SHA1 7ee36c998067cae6428b6888de456d544f77a126
- SHA512 1e70c8805731aa1fa318f92f8f22ee566a4ed726ef0635bb87a43e3ce745c9ebb4ca36d5348eeb5d10ff3dce57a2fd2025370c49458604dfef8d53c8b85e7595
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzg:CTWn1++PJHJXA/OsIZfzc3/Q8zx6
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5253) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4848-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000a0000000233b7-2.dat UPX behavioral2/files/0x001d00000002292b-6.dat UPX behavioral2/memory/4848-1120-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4848-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000a0000000233b7-2.dat upx behavioral2/files/0x001d00000002292b-6.dat upx behavioral2/memory/4848-1120-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAI.TTF.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp 715d7006cc82190bfea1218e4ee4016f83e66a4861f0b0b18f8bd113c736e299.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 47KB
- SHA256 299281eea8dde392ba36e250d57b7404b5688b525a6ed32173e248a0d2bd0572
- MD5 c83c3766f855c03d9cb6416c12f25823
- SHA1 3aed748c2d2b64ba69b861688a7094aea73a454c
- SHA512 6e8227938ddb09b8dd56129596e1fe4681f10f4389c02861f0dbbbcf164a9a6e8a611b8ccd2c964f0f3f36497e3623abfe8f7378ebf39b455cd4af9595350311
- SSDEEP 768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzb:CTWn1++PJHJXA/OsIZfzc3/Q8zxR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 146KB
- SHA256 f8b50dc9dc08c37858a3133376171c6222fa6c062a3fc6fa332ccdc6eacb70bf
- MD5 7507821c2bf7e03d27ac1a0c7a46c70b
- SHA1 004d03f7d4e0473b4bd5b56819232ee119a307a1
- SHA512 e31e319d6cc139da8eaace1371d33f93d1a00c9933446bf189206f6f6f00264db89edac304552d17db902772b670a3f05f11958327a9210751918bf6d5367e4f
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxu4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0G:KQSoKWHIjN3tj6qnv0b2UrXkbvLR
- MD5 SHA1 SHA512 SSDEEP