Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:39
Behavioral task
behavioral1
Sample
a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe
Resource
win10v2004-20240426-en
General
-
Target
a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe
-
Size
80KB
-
MD5
7f5cbb22e110840f854e9c0971ac1d65
-
SHA1
e761f30b25a336e40e7c79ef6d644c710dc66d83
-
SHA256
a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee
-
SHA512
dc316e3d9842128821d1b515fe180e6953d623c4709c3fdf28568df1fcbbb311f4ba0261a472d39c00ec2ab11462406dc8573acf8a3bc7a2d680e99a89e68008
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2Il:fnyiQSohsUsWU9BK3l
Malware Config
Signatures
-
Renames multiple (5132) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/2652-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000700000002327d-2.dat UPX behavioral2/files/0x000800000002294e-6.dat UPX behavioral2/memory/2652-1864-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2652-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002327d-2.dat upx behavioral2/files/0x000800000002294e-6.dat upx behavioral2/memory/2652-1864-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hr.pak.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp a92e75f4d614847e1d8957bcb1940e20e6f1b8d80c987a6216cc9126cdc86eee.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD50bd017e59d7807ae0575dc22bb98761e
SHA1b52b8347ad2ca42fd906e3441a8707c5b248a117
SHA2567f8f3c9f828baeb82f28f28897a671ebc78b60934d44871347d1f0e5df110b03
SHA512877292f917eedec9e877800c7f40aae62f5c4c7a5e8b89cb2495b395d7edd6d0ac7cd4420327b249f57c2eefe122219562621c984fac761f4c0d577578724dca
-
Filesize
179KB
MD5654d8f8fe1bfcba98010c10c67b7db31
SHA170f186326d4add625aaab81f3021db71b1b9a30d
SHA2563c3f9366c64211f070a7a76f1fbcc9e3f6f45aa9c138452571f5f63422e7708f
SHA512ea38317940be90d5c543333992fae74e236cf1ee0af7f9fafeeb259ee0af5127e5fdc4d41e35c0a4f65ec544480a0997414529cd5f1a37ad824e3a27ef1a3243