Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:36
Behavioral task
behavioral1
Sample
a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe
Resource
win10v2004-20240426-en
General
-
Target
a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe
-
Size
92KB
-
MD5
4612de26fb930a321b0ab8c2365445fa
-
SHA1
b783563db3dd7301b77433928cf542c33463ec4f
-
SHA256
a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b
-
SHA512
dfa59052dcd67bd878153ccb0f139cda0f4a1d7bd7d03f522458b17bb11c8e44a08d45b4e479add92bb940a136eb55d8ba5d67049f773089571839eb0a7697d2
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2IBi/:fnyiQSohsUsWU9BK3BW
Malware Config
Signatures
-
Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4892-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x00080000000233fc-2.dat UPX behavioral2/files/0x0007000000022983-6.dat UPX behavioral2/memory/4892-1782-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4892-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000233fc-2.dat upx behavioral2/files/0x0007000000022983-6.dat upx behavioral2/memory/4892-1782-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\vulkan-1.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp a83171fe85450b97765b2ea1cb7e7fd5b853ba0b7282092ae132a9579e07eb8b.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5d6c7a1e3940290a3505de1991b1d45cd
SHA107522383b583ebaa1288850fd1adc4c33b2519bf
SHA2567a32894f4c285d8eb4a7fc196507c891258e7335a8c57e3f95b9342d17bd9b0a
SHA51298d7c4e6ff72312a16144935333d19e0a7ebc998e87cc57fa28816574005b5cb07a742cf2359f349da2460043e520110a0418bdbfca09788882eb64fd5f16df3
-
Filesize
191KB
MD5b27f15757ad6389d29606f6d2705d82e
SHA11994ddf77c0b078f65a0be1cf1d43d27d0a7607c
SHA2566acb31cad7681429ebe2d334a11ed08d8c0ffacdc613c1a8ffc278c9337a7ca3
SHA512d234f646c51052346b0c15d1d3ade0cc2a641f6d343357c3713831c2b215b03779f1a1e2319f59dadb4f78fc9412cd43c4a402f2488d6de983f0ff205a739e30