Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 04:24
Behavioral task
behavioral1
Sample
e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe
- Size 69KB
- Sample240611-e1l4zstgnc
- SHA256 e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc
- MD5 bbca920ee6f6bf1884639bd653a5505f
- SHA1 978f64b1db7689d2161deb7fe4b739d3e4e50754
- SHA512 6bca8cbd30b38d511f79d9df12a7bc69eb1f0abbdba3d10ac4a91f28011bb6461215a7539d6948de5ec77185e0fc451081a9c5719a3d514711043d0c401236c9
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXch:a7ZyqaFAlsr1++PJHJXFAIuZAIud
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5268) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1928-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0006000000022f42-2.dat UPX behavioral2/files/0x0008000000022970-6.dat UPX behavioral2/memory/1928-1950-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/1928-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0006000000022f42-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/1928-1950-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\AssetLibrary.ico.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp e4d8018d4c4b0b2adc32e26c0dc05a8ae405e9de1e384fdaf194d7cee3d82bbc.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 69KB
- SHA256 4ff2e5a7d21f64d5502d43c53ac48d317a460ba91a8adc398a453341786d8137
- MD5 a637e3ece4cfe645a70240761a6ca6a1
- SHA1 f69e67f63c3c865eb94720ddf5a8410c38fdfb15
- SHA512 6f9f0f2ecb38ca8982995ce0ebec39dc16501db4902424ac6a446e426159ab620194a561dba55c983cf6845f81691cddb5157bd115455f77810481f88f721dbf
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXca:a7ZyqaFAlsr1++PJHJXFAIuZAIu+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 168KB
- SHA256 29eee0f5b5e1be3f4bc8066be231f7e3d6198471033c63192e369b985e585463
- MD5 170e19da3776303e1dd69d25d42ac21b
- SHA1 a4d0c5206f9a435d33ebd876c4644ff2f55e3b7b
- SHA512 cb0723dba84d7d5b46a5f82b44970e524b5634328bcf1da392f9a06ad63303b63e15456876ad86906b52619820b623f268cb79be216342e9eff23e5b4c6a281e
- SSDEEP 3072:enaym3AIuZAIuPWHIjN3tj6qnv0b2UrXkbvL+:wHm3AIuZAIuEIjNDv0bNXkbvL+
- MD5 SHA1 SHA512 SSDEEP