Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:30
Static task
static1
Behavioral task
behavioral1
Sample
749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe
Resource
win10v2004-20240426-en
General
-
Target
749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe
-
Size
47KB
-
MD5
259acd55665179cb120ec1fcc52e61ee
-
SHA1
fa65a71cfaa499a2c64edbd93c85f1d66820de06
-
SHA256
749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a
-
SHA512
c8ed0ec4bbaee06f14c27355aaf00b8a84c428cf7e38b166bec2ec085a540820a8a20921b55eda534262b00a2365aaabf7f3d31c184cac59f7aa2f8b4cd514f8
-
SSDEEP
768:W7BlpNLpARFbhblkYlkuvIYFWcDYcDrf11+Nwf11+NY:W7ZNLpApCZuvIYYoYox
Malware Config
Signatures
-
Renames multiple (5211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 749a782b13a0a94a55b4b3673b4268edd978de9edb301b0e0c21050b772cd84a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5677335d50a23475caa14839d5250d5a6
SHA15a5d251f57f55e8cc673919ce7595db866ad2c58
SHA2565fa9e90937f12a0b43cb4abdf041a3511fb4f2320143bb16f4a7e184e514a40a
SHA512c97e5a27b4f0d41010ec99157a2dc205a67acf6dccee75cf6c78d6ea3de8d48b3899179bfc4fc70ab40d2327c770ca2b91067348fa90f71a8d3563cf8f0fd735
-
Filesize
146KB
MD5c506ff74e6ab5bfd2a8f2c30f8263b92
SHA13f8ca1179f5f2bd42ae112fc000808dc86332268
SHA256e235bbdb0cab41872ca3ac40bfe8b170b4318f24ff406909d97451835d2da7ff
SHA512dd2987cd238f0364c2cf5f8d686bce0d704e331d2931c19396183f4b33a759891c7041d59880c46c8b68ee2b1cc534200ac6a28b003182a3af17ce5f11244676