Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe
- Size 264KB
- Sample240611-e8n9bavflq
- SHA256 e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30
- MD5 495f8b06c3de5b32b3d642b7b6f78fff
- SHA1 780ec88d96d0b6d560c19753516abd4faeef8b3a
- SHA512 d6358bdb254ecd5f3d6c51eb92b9be852a590196c81bb277dcab45b6ba2b3899e0f516b05acc2bbbf8e8a5ecf65e1e7775163fb0453b2ef7cc98bd5aa97588f7
- SSDEEP 3072:6NLWpCZY3hfl/4bFtf9aRzc29Q8WNHm5xOrjjChlwAKRvyL:u6v3hfl/IMc23rgEL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\hr.txt.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-BR.pak.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe"C:\Users\Admin\AppData\Local\Temp\e9f15ca47f4e847b6d90429eb7140737462a123ad72d4015af657969e5941e30.exe"1⤵
- Drops file in Program Files directory
PID:560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:81⤵PID:3652
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
- Size 264KB
- SHA256 7cbd211b5db127440f356a8b3a4d3cbc8c391dea3feae1659b86616c950c85bd
- MD5 f94456839e872f4a869ccbaf912d7809
- SHA1 41e97591324174fca94487947b751be68be96bf3
- SHA512 d7f75646413fc01a689548d9d2c8bcacc8e6ead1d539ac51631e667407028fb433eb1e8d83b7731b36020b35161c769ce459d7ee48b17299c658dcde142dd58f
- SSDEEP 3072:6NLWpCZY3hfl/4bFtf9aRzc29Q8WNHm5xOrjjChlwAKRvyl:u6v3hfl/IMc23rgEl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.chm.exe
- Size 376KB
- SHA256 4f68861e1f6f4d47154b61119d999b04d52e20e1b53c95664dcd28a2e6a882de
- MD5 afd031c7f0e4af707bf1653e9d72de6e
- SHA1 4d36f978faa2cdc004a9a782fabea6b273d9f334
- SHA512 0d658da77b396b2361ed575b3d436172e05551b9ea598a91edf548eba3ff6cb3332dcfcf5138f9157762590c71b4c8f27e89168b2cf20767a89f208334ccd932
- SSDEEP 6144:u6v3hfl/IMc23rgEYJ3a3LXGZkUcTb1JcrjQ4y:74ZgtYJ3a6ZHcVar04y
- MD5 SHA1 SHA512 SSDEEP