Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:32
Behavioral task
behavioral1
Sample
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
Resource
win10v2004-20240426-en
General
-
Target
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
-
Size
45KB
-
MD5
08fa023a614800c5c2096b5b1827996b
-
SHA1
54a7ccf761a1f0d79773289485d2f0452e496c9a
-
SHA256
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697
-
SHA512
523e415ae8dba0f53cd7c3eefdb26796e1b521edc295b8f9834173a5385cd131932427b63f973c93adafdd66ea50801e5b7eac9af078cc43d5bafb5a9c809650
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzb:CTWn1++PJHJXA/OsIZfzc3/Q8zxp
Malware Config
Signatures
-
Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4404-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x0006000000022fa8-2.dat UPX behavioral2/files/0x00080000000229db-6.dat UPX behavioral2/memory/4404-1086-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4404-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0006000000022fa8-2.dat upx behavioral2/files/0x00080000000229db-6.dat upx behavioral2/memory/4404-1086-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fil.pak.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD57c0896e869e4c6f91ac1a3af9632b504
SHA174ee7f9eff0cfd0e798e420fe17dcfee1d02d41e
SHA256fb8598d2fc797e3813ff3f92ad1dbefcf0f260897c64eb36e233f0972ee679a6
SHA51228c23b2b1ca5d4c822113b97416405d569e00e7566dba03d848d25f11ba7e80813ff2a42e80fa1bab4b79f1de1a9ba415865bd7efeb2ae0fe1b22864ed66e1c5
-
Filesize
144KB
MD54f944e35f62d93255a6122b6c48db9c0
SHA161c1f399b45e491559e7505b9fedaf8b4129eb99
SHA256c639f001bbfe86ee1c3c7376b4fa6a12699cb869fa93166f278986fceabb300f
SHA512352a0dca192e7b2459bf598eb422f06d8d2c9098b7ebe22ada658134ea0fc0c26d3ad2f1f57931c8220b2d0ccd4d2963507055694f1aecd2de198977e4134fc7