Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:34
Behavioral task
behavioral1
Sample
a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe
Resource
win10v2004-20240508-en
General
-
Target
a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe
-
Size
70KB
-
MD5
c0e1d53a01772865c234c448088f0c8f
-
SHA1
8eae885b8636979c5370d79cb4cfcbd73442e6db
-
SHA256
a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916
-
SHA512
08e35cb943631079893667e2aa9e7824e34ae2fab8b0a4a9ce712565f035f6dd03ea0570df7c7131cdec623c9b6246a065fcda017e45dbbec7ef024b491299a5
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx9R:fnyiQSou
Malware Config
Signatures
-
Renames multiple (5247) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1856-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0009000000023547-2.dat UPX behavioral2/files/0x00060000000168ae-6.dat UPX behavioral2/memory/1856-1970-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/1856-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023547-2.dat upx behavioral2/files/0x00060000000168ae-6.dat upx behavioral2/memory/1856-1970-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\LimitUnblock.wav.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe"C:\Users\Admin\AppData\Local\Temp\a745cc59d77cdaf622c31385d53bb30b03fc23756b757e7d59c53e32ece22916.exe"1⤵
- Drops file in Program Files directory
PID:1856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:81⤵PID:4676
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5f06955cdefef7ce1a69f356323f91f1c
SHA198aef74fb17252cab61f03fcef0197da4c61b93b
SHA256dca245d4ceea58751b896c48b4e4cbd394c6f49dcdeb3ceb61087a7f5b6a0ab5
SHA512c75c5fb3c0643f7813fcf099f53c5eb533a2183ea0dd7ba6c3429db076e3ff0da8cf15db15b7c76d6f62905c96e01e2c09c885603d3a1c3130487a921193bcbb
-
Filesize
182KB
MD5292e320a6962250999e8bbac8458bacf
SHA1698c6afbd576970e59e43190831753e5c9760477
SHA2565378050f99532064bcfcfe788f45f2d4e44055f96187dcc44149931410023d44
SHA512b47f5c86fc2eeb6a6abf091ad555b3fd7a09f026b26d7fd677d435f8279d35c872a83f2a7d967337663a854c37c7fdc81bb457e09ad0da5cec8c74d408534b5e