Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 00:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe
- Size 46KB
- Sample240611-a8acyaxdrf
- SHA256 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a
- MD5 a6fe767607d52e95798577c61cf7e409
- SHA1 bf56ad1ee640f71ae396002a0868277067860c7a
- SHA512 43b1e1ca72269f2ddfd9f4a75b279bd8b94d751b93a42e3dd9152bae337569d7e8994821c475d6ba3f2169d2d9c882a86c0f2cb1f58f4aa8740e29bfe33348d4
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNmID:W7BlpppARFbhWJQiP
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointTeamSite.ico.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp 9658a2c73505a83e794a5ce83db081803536bccc180783c411c31b9f12bcd98a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
- Size 46KB
- SHA256 3328617c0a2374d12fb3fc4fe28912bd8dc77addbcd2c29f5fcf51d0866b50ba
- MD5 308ccdf6dd51f3f97c2551c19f8ff7f5
- SHA1 1a2614c9a350fab1c5eec6a67bf72eb775300fbf
- SHA512 af117cbca8237a3036be0343bf45697e50affeadf3f773d44721de2825004355a657c79c554ddb3b0c194b3b563c093c57d9073812991b262ee63c02ff676ee4
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNmIa:W7BlpppARFbhWJQim
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 145KB
- SHA256 07532dbcc3a48cae1ed8cb5817c50964a4ae89e81d91d6aaa6ee3dc9dfac77c5
- MD5 54455bb94043ebce0c7cfd1cf1b3db6c
- SHA1 d10b50bb65924a6d095b057f5c2f88ffcf0d3fb2
- SHA512 82f7f3e133d948cb85b764a88073d1e7174684f7409a9adf2917f0a14999c9a040db3cfa20c7f2751fc62a2c8a3ba9d1efbcb3e923bbeac8215fe706f4d96d14
- SSDEEP 1536:W7ZppApHiv4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DdL:6pWpHi2WHIjN3tj6qnv0b2UrXkbvLd
- MD5 SHA1 SHA512 SSDEEP