Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 00:05
Static task
static1
Behavioral task
behavioral1
Sample
834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe
Resource
win10v2004-20240508-en
General
-
Target
834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe
-
Size
88KB
-
MD5
02c98e9994340f35b2c8bf964120e92a
-
SHA1
060a5101476f37ef4c6f67ac05a5d25b019d34e1
-
SHA256
834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29
-
SHA512
3170e25d86cb7a0e271691acd73ea5c74e16a756d95e1ba1ffbd5321d4a40cb8bb6ac8f60d1770f2154b04e4265bbbb0f5bb7260f352798f711b56726c17451b
-
SSDEEP
1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPXW:6DWpwE7oL2e+efZwZ08i84
Malware Config
Signatures
-
Renames multiple (5200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\ConvertToRestart.vdx.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5be3d8129d1d74244139fc397f1b282bf
SHA16b3e72039f7ad41b908925ac731e27f5821997e0
SHA25609da2edbeca02b4202f61f7ac2286111729158a1d27d177c52aa99d4bbb37d46
SHA5126d7187421378fd5e1e2f15f7649a7e35aafe2c565e6345ffc4f2b2dd3c70495881f8a21ee47f9f2b41114a80c9ab919851d1a7f6292a9a8cfa33d6ab755d363a
-
Filesize
187KB
MD5ccd17543f8be6dc24118a07156c422e6
SHA14a3701f409a2585d45b0aecf5f08ddf74e1a95b2
SHA2568e8c36336833b703e746c10fb1ce17d6abf3af3fc9879e3e524218f5e895f6c4
SHA5127513182e16ac8171405a6f83a181f93218ece022c0bedd3f72d8b981f077b1a97fe55a8e913aec1da6da67617683e4ef75d04f2671f3d4ff405e5587df8e7417