Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe
- Size 66KB
- Sample240611-w487cswgnb
- SHA256 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35
- MD5 514f0262b03d2c2af7207aa5badc2bc0
- SHA1 594841f624cb6d97583711a2027a89464b1f284a
- SHA512 c999d8af855e727bc3dc23746e0db0790c068da011c27d9831218503e7b06fa4feaa12d7d7d2ae3dcfd84f39b5877533d040fc21074a3106725de0e6bf119aa3
- SSDEEP 1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888x:9QWpze+eO88888888888888888888884
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5008) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\dotnet.exe.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp 09ae95b5ec617ed5f19d8845b763d57832ca5564d0afe25ba437ebecf95c0d35.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 66KB
- SHA256 2c9c3fa09cf1b9d68ea0b86ca9743f084c2e1137ed0ca0dd8dd528a7719868d8
- MD5 a2ab2af01e7b4a11e1194f2ebfadabb3
- SHA1 6262e12830df748fc15ca51608d0c88ba42383d9
- SHA512 b2b9b1cbd5d140999a0d3599695efe0c25ce715b8b7979a0aa954d5b20278792f0c13542edff72164f69a3505afb384add5e3ca92744ab61ba7846b7f9ba67ac
- SSDEEP 1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888r:9QWpze+eO8888888888888888888888G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 165KB
- SHA256 f996c6c7661311f31f15031202f0becb12c3e53247e0540c222b337fa247a6a4
- MD5 c0e5faef9e7ade80abffa7d23123c9a5
- SHA1 bf67f0751ce28aa80502d8629ed684ce39dd24cb
- SHA512 c308ba294edc913d865bc5e16d50c64e13afd6370094e24bd84dd41883e8f5bfcff08869a377342e0eb945af7d4bbbfacece57c0b9275b75134bb8a72c4fa63f
- SSDEEP 3072:9QWpze+eO888888888888888888888888888888888888888888888888888888w:Lpe+eke/IjNDv0bNXkbvLm
- MD5 SHA1 SHA512 SSDEEP