Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe
- Size 76KB
- Sample240611-c4dkxasaml
- SHA256 bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c
- MD5 893a8f4df1d3ea8f46cea02b193bc87a
- SHA1 2a540547a1eaee3426459e80282ad4f392036bbd
- SHA512 7c6bb935f4acdd7c37f89206004c05e1e46d1034f433d4f7842059bc7dcc298bea003d8fbb4f9d3713830a91074825fffbe9f4d614ce838d78d6c22dc00c40d7
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHz:W7ZDpApYbWjIlE77ufL2e+efZwZ2rF7
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogo.png.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp bceb309dd4f571e7a2dc30170f05f081fc8004f66f7ce701a9d0e8f49ba7063c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp
- Size 77KB
- SHA256 8a1364ce4b9352fdd905dc1d554fa2faf405e2d6514d24e94455728f3ae8571d
- MD5 d3d36d32bd6e33008fe945cac7a44575
- SHA1 165675c9e68f33059d9b470e647c24dbc45431b6
- SHA512 43a15add9a994c8e2d434634e99b8478fa429dddcdd0031c8c07c3a8aaee7f38a27bb3408b7867e9ad7db9617bf5bacf644646d7205296f8e72a5712b6c474b5
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHy:W7ZDpApYbWjIlE77ufL2e+efZwZ2rFa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 175KB
- SHA256 e62bf39858a6aae9722b5a8dbbf7eeba81b412f02ad4ce2ff8efa83ede4fb3d6
- MD5 6868a08d24947495160083dfdb028eb1
- SHA1 b09448594c176db01163f96b7e984fa2cc98da99
- SHA512 cbfa8243cc895d25d1cf8e52789921b06e9a40f52ecd74c912c550de74a8bd983dde9b9418a4b4dca00bd08e48ef747942c5d350269eab8a4cb0c31e402ac1d1
- SSDEEP 3072:6DWpwE7oL2e+efZwZtWHIjN3tj6qnv0b2UrXkbvLG:dN/e+efikIjNDv0bNXkbvLG
- MD5 SHA1 SHA512 SSDEEP