Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe
- Size 78KB
- Sample240611-e4vwasthnh
- SHA256 e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0
- MD5 51e02e8d59740f7f25d0f042b37e89d5
- SHA1 a606419fa64903daae4780678080c93c835f4124
- SHA512 ae17eb799a88ba3ddf01ea910ba82ddbbfd12d211a9e069a52c572ef4ebdffa1423f298874607bbc643b0f1629a4e06806152f31155da113cf127f51caae60dc
- SSDEEP 1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696xZ8:6e7WpXYvndw
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\7-Zip\History.txt.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BSSYM7.TTF.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp e753d120afc980651b2f8ae1ee6d0285f8c2a119da5e577bc4d1ef22fdcd94d0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 78KB
- SHA256 f3306ae3ba7bcf26b1c40489e106ed930e1d2eb6828f8c4a12a4115f75e29477
- MD5 60efe8cf8875ec2800f99cba90e56b4b
- SHA1 2c92edb9389212caaacd78a56b624052bc3d0cae
- SHA512 18f0168425e1862dc1aaf34bab34256037d77557df5fa63d4a7cf700d206c5878a7a4fef1dfaaaaa72f98ae69cd9945f7181588341e93cb4fe5e62fe21b57303
- SSDEEP 1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696xZE:6e7WpXYvndo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 177KB
- SHA256 c2f99fd7ba77339c0597dc59b436b4e3d507f0c6ef44f77e720127ec9709633f
- MD5 e6f30bb1a7a80912cfcd187e5949e659
- SHA1 17826b27b8190de93fc9d8534b2945af0b816ace
- SHA512 59cef8a95010a2ebda3b144be77364b4587d34edcc2f465134e1ae3b07178d7dc718f3ae0a39347a7928b7c296efb7fb026b6897dadf35fe1fa3d270906a3114
- SSDEEP 3072:6e7WpXYvndFWHIjN3tj6qnv0b2UrXkbvLq:RqRSwIjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP