Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:44
Behavioral task
behavioral1
Sample
7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe
Resource
win10v2004-20240508-en
General
-
Target
7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe
-
Size
59KB
-
MD5
aa6431565f4dcbffc10f4686771ccf34
-
SHA1
cd61034af1b6c8371ca70101e97587e5dbe6fcde
-
SHA256
7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa
-
SHA512
ef7286d9cf2d6a448f00ff04e35682036686ccc692395262a82277c3cc865367fc0fd867fc847904f1f277527f4c23a0c452899ce7650cc42648163b384020b2
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2Iz:KQSohsUsWU9BK3z
Malware Config
Signatures
-
Renames multiple (5271) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000500000002328f-2.dat UPX behavioral2/files/0x0008000000022970-6.dat UPX behavioral2/memory/3552-1214-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000500000002328f-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/3552-1214-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp 7adc2acd5367312f11cd7afab5672244e54af643dc15658afdbb01556cd55afa.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5ebe97b029c3288e24c2a0d5114ccaf5f
SHA17ad8700137776cb5d1b958055486f0ba4a7728d8
SHA256b399af7ac00118a9247f8c19cd606844e43a455916306e21f423a7663b03d37c
SHA51236a35691d4d9c3bf8928a255f3ff0306b99601a804e52f722f7453dee693601bc1a3c748c74fa2ee642d5da62c96393405ecdef280747fad058f54d7ec19abc7
-
Filesize
158KB
MD59fdaa42c95de610154c8e9d64e07cb45
SHA1a6d0c525510475ae3fa07b3bb78f4a8db793ce81
SHA25681835c3e30bd9978ab9a2ecc3a0e8a3f40c5ca8cbbf00f7a7014ad4a0165fc70
SHA512ce355d8b9c4babce118931d1255ca66d4523abc294a404e823ef1ce1fc66049eed83c25443ed00dbf8786220cbbacd8d792700f9095b1f150dc4e75214e6e1e2