Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 01:45
Behavioral task
behavioral1
Sample
abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe
- Size 85KB
- Sample240611-b6s8pszanh
- SHA256 abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc
- MD5 09a922ba8d92102a72b273ebd050cad4
- SHA1 2fa3c1d55b3662b39450da416f578abab1049792
- SHA512 1e03224f2ec11c7dea643f38b58cd32ace27b5baee5d6a61b6a81835a90cfebf5e43be24060ff02ba238ae27384271f230e6b6435e9dc48e9343bf2fddc56194
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yin/JDSDdup:fnyiQSoC/J+m
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4962) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4780-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0007000000023305-2.dat UPX behavioral2/files/0x00080000000229db-6.dat UPX behavioral2/memory/4780-1790-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4780-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0007000000023305-2.dat upx behavioral2/files/0x00080000000229db-6.dat upx behavioral2/memory/4780-1790-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp abae2e42817afd9b14291c77742f453daee93986e1519758e8fc95ebedce59bc.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 85KB
- SHA256 02061fa106912db2473d85a07977effed0d7df5d6378081680e2acc62ddeaafa
- MD5 c99904fdb8e2cbbd68e1b02ea9625e55
- SHA1 5461ae4429dabc7ea9172d6f8036bc76d7b3e88c
- SHA512 8808c2540d686c86d0201b41be33069be70e89fe2cc6f48c719c26ae4d0836656dcfddfadcc22f3f00a36b5e01c5dba44b42db907423055bf51b030951a5c8e7
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yin/JDSDduC:fnyiQSoC/J+Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 184KB
- SHA256 2673505a5f566bebb74b7a7401343f14f2fdf9bf0b19843871b190a6f9087d72
- MD5 733a7fc13a18cb58729d59fe7d2429fb
- SHA1 e0db004c83fdb0e187e35e8491e89f3471388de3
- SHA512 a2186139dcae7690e30994f57e68528361e35bf83798f9ac929d89d0f521ab0d79ba3d825eda55e2b47ecc30851ede50bee6ccf530ca14595f6599930a611f40
- SSDEEP 3072:fnyiQSoC/J+LWHIjN3tj6qnv0b2UrXkbvLK:KiQSoC/3IjNDv0bNXkbvLK
- MD5 SHA1 SHA512 SSDEEP