Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:40
Behavioral task
behavioral1
Sample
a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe
Resource
win10v2004-20240426-en
General
-
Target
a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe
-
Size
85KB
-
MD5
02b78a00c3b0e1fc1451c31e07dcde3d
-
SHA1
cde2662b56b1a877897618b5f77dced2e0472f0d
-
SHA256
a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90
-
SHA512
4b0b1e1704843e2ec8882cd0c3e287c5057db1cd1381373a003169cc3b5a357f7636c0b3d12ae0987bd0d756249b3915b43a3367998a8f562beff291b475edf9
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2Id+W+o:fnyiQSohsUsWU9BK3R
Malware Config
Signatures
-
Renames multiple (5089) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0006000000023288-2.dat UPX behavioral2/files/0x0007000000022959-6.dat UPX behavioral2/memory/4948-1886-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0006000000023288-2.dat upx behavioral2/files/0x0007000000022959-6.dat upx behavioral2/memory/4948-1886-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp a9d097432514801c4f157ff93b2f855ea9b582594dd556d4b9404d0da395fb90.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5e2a934230f596579b8c36375935f1141
SHA188bf16e8f52d7c5fb349424b26a96e401c36f964
SHA2560e1594084a1b5ccab7e81b325a6fa63e40cc86e91c6203214bbe4bf20424a41c
SHA5127891d51ec74b63eb593a992e14b8acd3f91a11442edfbc1afc24165ddd05ce406d21599dfbabfffbe4f937ecac62134ab964006940d1ce211fc3d17cd2237686
-
Filesize
184KB
MD5f9c496b348e9ed4d16e2ecf3698dfbe3
SHA1de7f435f4c964978675d68163c3f7d47e41216fb
SHA2560cf7fe9c75061bd70bb8a10eed002f4b121bbe5682dd12d659bef19c50684a36
SHA5124f112d10a8acf5604b341945f5f9cab635e15eeb5ec7aa04b746ea1b58b505325cea8fa9285753b594822cb66a195153161ba7e7eb60998b87c2a123fd552762