Analysis
- max time kernel
150s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 01:06
Behavioral task
behavioral1
Sample
9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe
- Size 132KB
- Sample240611-bf5h2sydlm
- SHA256 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3
- MD5 447e32c766f5b73128c15d706cbede78
- SHA1 5c849face8fa2a0a18be3ee00fbf01f3caf028b3
- SHA512 3465f2e15ed115b9658da681829bb3f6fbbe4afdc9a0fa7ffee03e96a876b46b81ac179bfdad314a8869b78fff4a9ed9d322476b55505aeee071dcfd5df9e86c
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97nHSTWn1++PJHJXA/OsR:fnyiQSohsUsxe+erZaQSohsUsxe+erZk
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4904) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3400-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000800000002327d-2.dat UPX behavioral2/files/0x000800000002294e-6.dat UPX behavioral2/memory/3400-1780-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3400-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000800000002327d-2.dat upx behavioral2/files/0x000800000002294e-6.dat upx behavioral2/memory/3400-1780-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\7-Zip\descript.ion.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\am.pak.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp 9c8dfd69e53d3190b1c3232996183ddff0df903459d07fe6aba770d9e522ffb3.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp
- Size 132KB
- SHA256 c1d310a6b7c9ec2e35e1756e7a8f054e9ed06eccf6145c526fbafb940f0f31ec
- MD5 4427b7b60c35026e6e90dde77d6db6f4
- SHA1 02f213e0ff05739bfce4a7898a209f42759077a3
- SHA512 1a7445199a1992c087849b680d329817662f2393c2c9e533744326ea4fd73bf624bd07e29f0db192e38ff6b78e09038fda2af5fba26c93dec876636a81814eb1
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97nHSTWn1++PJHJXA/Osj:fnyiQSohsUsxe+erZaQSohsUsxe+erZK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 231KB
- SHA256 d3d31c61773775a7965d4bda6c34d4f528716920c29ccc0cb1641149018f9012
- MD5 57f4031f5ccd44da6ead3b0b8e22521d
- SHA1 84c971f7fd135ad32288d2c5a27d45eed937860e
- SHA512 61b32f9d7d0b678f5827b66fe77e8f14605d4c91584ae583b19546f3a9b1790eea7ea6c8a92d5e506db3d7540ca45447c2a63f2ca1bf52b1951f66b2e407ab17
- SSDEEP 6144:KiQSohsUsxe+ewQSohsUsxe+eOIjNDv0bNXkbvLg:VQthsUs7QthsUszIZGNXkbvLg
- MD5 SHA1 SHA512 SSDEEP