Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 19:39
Behavioral task
behavioral1
Sample
23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe
- Size 113KB
- Sample240611-ydf41ayflc
- SHA256 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b
- MD5 40718da0467867b2ee532246eef9e85a
- SHA1 a0cab4a7c944d170d35d1e1280e0cd383adde485
- SHA512 2e50f55950fe61154df3e9264a94258935f221e923c231013623f69fc4ce0880cff4afe12cf282363e2fe02b878dea79b957620e29cc68e5f2abafdb45416356
- SSDEEP 1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfagS:hfAIuZAIuYSMjoqtMHfhfagjyZ
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5156) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4912-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000600000002326f-2.dat UPX behavioral2/files/0x001d00000002292b-6.dat UPX behavioral2/memory/4912-1108-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4912-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000600000002326f-2.dat upx behavioral2/files/0x001d00000002292b-6.dat upx behavioral2/memory/4912-1108-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\mce.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp 23afc3a97c8732e4b2ef27e4058dbfe267d39e9f02ce05dc999d20c89fad8d0b.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 113KB
- SHA256 4fc85440b7f158ff56505c8a655e7118305211b1166cf8b14a0f1d0cab629c1b
- MD5 1977252ee7137e932079d1fe3fc45a99
- SHA1 3a634d14e0c0ca0f967ca183345c86a0e9bc1815
- SHA512 6b76e68d92b1428f78b40b967bf0f7429c91233020f7cfed859eb112246aa8a54d3f86660706d34836cb81085754baebd97094bb6bf54262fc5bf293e01db519
- SSDEEP 1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfag3:hfAIuZAIuYSMjoqtMHfhfagjyE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 212KB
- SHA256 2f70cdfc0858233649edfea73678f6aa5b42a00231393e7707f69f7716faf816
- MD5 968e22d51ea7068c68a17d58a1efb1d6
- SHA1 ef78aa483cd89cb7952312a078790da7f125b0cb
- SHA512 ed3032506ed8419a228b716b242a7644832f99433ab4ab0b05dd0726e895c8cd8f34a38e70941637e782864bc8f8268717fb55446c00f5a5419b488df0d281b8
- SSDEEP 3072:hfAIuZAIuYSMjoqtMHfhfagjylWHIjN3tj6qnv0b2UrXkbvL9:hfAIuZAIuDMVtM/sgnIjNDv0bNXkbvL9
- MD5 SHA1 SHA512 SSDEEP