Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:28
Behavioral task
behavioral1
Sample
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
Resource
win10v2004-20240426-en
General
-
Target
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
-
Size
98KB
-
MD5
cd9f2391e7770809e85392db6c3645f0
-
SHA1
b400e04c6d056a46faeac733cec58f96f5dbfaff
-
SHA256
a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a
-
SHA512
f4a8445cdacbac04143ef8081d5337fc73de3a53a276dcb705b8b431c856a7c69026c4bcf28beb2243df085a8298cc8dfd11aefdffa97c089a6621583bb7248d
-
SSDEEP
1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQul8:enaym3AIuZAIuyxJrQul8
Malware Config
Signatures
-
Renames multiple (4855) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3104-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0006000000023298-2.dat UPX behavioral2/files/0x0007000000022983-6.dat UPX behavioral2/memory/3104-1778-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3104-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0006000000023298-2.dat upx behavioral2/files/0x0007000000022983-6.dat upx behavioral2/memory/3104-1778-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp a5087af087c99c645202dfc1e0134c4f029a6b69a9f951d0475bbbce74fb7c4a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5830a6e18f441e49668c188691207dbcf
SHA144d9ad31ebd9269cab413bcd1c675b68a0c2f35c
SHA25605cd8c23722dbd23a2735ab5dde2e9c2bdbd2bda40e7455e187d1d95da3075fc
SHA512b53c267ef2ef73ad768a322b47a3d4262fb53430793a6b4b841aa39dd1aa468d0c32269c1c06fa2f532fd709b326bac08f5f8002d590a78aff8b8934cd6f8f38
-
Filesize
197KB
MD565e9d9192ea45d572e3f7f5ab88af32c
SHA12dc6636a1cbf5486c51b5bbe45411e74fef1cc14
SHA256adae6e8f93e04de2d275973d47f9f7eac4bbe9706fd7ddf0c469824c5539a812
SHA512b3d86143319cbd84d2b365ef5cc56f3964762e88ca6385664c5ac96fa6e4483cad593301b1d835dfd802e64bf8d3b8b2b4cff24855e9bed1a6b024b7f1006c7f