05b35452d5be37abeea1edbc6ae317d266519c63050ef385708986188820be9d

Resubmissions

12/06/2024, 21:32

240612-1d47yavdqp9

12/06/2024, 21:30

240612-1clzza1dla9

12/06/2024, 21:27

240612-1a2mmsvcnq9

Analysis

max time kernel
126s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
Size 585KB
Sample240612-1clzza1dla
SHA256 05b35452d5be37abeea1edbc6ae317d266519c63050ef385708986188820be9d
MD5 45b3c3f5401cc8f58480ddcf17295820
SHA1 0bbf87095245be58c5e8f6856940bf11758efb32
SHA512 91c6720c3448c0011229e933058c859343b397efa94992c0357de5ab914f74043d43703830cb33c79a4b157ebbfc3e981be14ff191bb17145d55c842f8022c1c
SSDEEP 12288:VQthsUsHC5/F3VzmbLikL6G6pTgkriXqCjvxozO68lS18r30c3PHuLvn:VINzsVuG6pTPEq25ozOoOHuLvn
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2596) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4532-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000700000002328e-2.dat	upx
behavioral2/files/0x0008000000022970-6.dat	upx
behavioral2/memory/4532-1280-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\ApproveCheckpoint.xht.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5276	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2856	4568	msedge.exe	119
PID 4568 wrote to memory of 2856	4568	msedge.exe	119
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4916	4568	msedge.exe	120
PID 4568 wrote to memory of 4560	4568	msedge.exe	121
PID 4568 wrote to memory of 4560	4568	msedge.exe	121
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122
PID 4568 wrote to memory of 3984	4568	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\45b3c3f5401cc8f58480ddcf17295820_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc24e7816hc534h4c55hacd0hff626ea787bf
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8923646f8,0x7ff892364708,0x7ff892364718
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,11813205697296477512,60540717917733683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,11813205697296477512,60540717917733683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,11813205697296477512,60540717917733683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3608

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log
1⤵
- Opens file in notepad (likely ransom note)
PID:5276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Size 585KB
SHA256 f5678d200c2a94ec458b025f7c89c4aab641c0efe1ffe629ea254b63df685acc
MD5 420a05e321a3293addfa1b3e0942e596
SHA1 e1ecb3c6fa8a511cea42823fc76ea94d80f2ccf1
SHA512 b537022d7f724cf8bb370be53dcd03aab3ca1fac9c10da5f790f2dc32265101abb140c1194b95af21cc28471cff33324c6f7ea40752c7a280ca95003f882116b
SSDEEP 12288:VQthsUsHC5/F3VzmbLikL6G6pTgkriXqCjvxozO68lS18r30c3PHuLvT:VINzsVuG6pTPEq25ozOoOHuLvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 684KB
SHA256 a9c15b1c2aa005689e07079582240f52b97a88d118161e1367298ba528b36b3e
MD5 054139822baa3a5c76c705785dece83c
SHA1 e25258b70ea102840b29a9e221f5958a4e067e70
SHA512 61ca08ff9547ad6ed9f409f8f03662fa0482223e257ebc649aa4c52ffa550dda020d972f625f825ad77a6943d40c02ce539b22bd6ec5ab175823de55d9e63d3e
SSDEEP 12288:VQthsUsHC5/F3VzmbLikL6G6pTgkriXqCjvxozO68lS18r30c3PHuLvLIZGNXkb6:VINzsVuG6pTPEq25ozOoOHuLvLIZaXk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

8c3f4f76-6225-4982-adda-3b683f6ce8a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c3f4f76-6225-4982-adda-3b683f6ce8a3.tmp
Size 5KB
SHA256 35c91c0b727a2632b0a1370f7b9330f94bd32ff0916687e6af47491758dd2e71
MD5 e3d0b406683d7fa2f24550d56195b75e
SHA1 71abf963fd600618289139cefe296c6866277c84
SHA512 abcae6b7da0cb095176bdb9ea7894ce3b8c2f6e76e8f62c7a47d37811a3f1115bd33dc07d37071f64bb757d72249691f587abfd7f8b8132d2a73dc6d79b6be12
SSDEEP 96:nqGfC681fG1wpvWMoiVmdeHBrAv1wSUWQyV+VDCAiEwb:nq6/8lG1GWMXG1wSrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5037fcb136e3049a1ccd8d64372907de28f36a2e77251e1d48858d093c8a6d30
MD5 26f78f883fd2dcc39e0b6883b6cd8ecb
SHA1 df158e9bdfcd0780bbe0919173192152371d0f59
SHA512 8e465eacfb457334a1c926fcd7aa1fabc7c6fe40423ee8b54247057c2000342730fdda451ce4d1cb26c8983cd21f49a9b2ffedf110ca9afedd8af59332ad65c6
SSDEEP 192:boCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfH2e2RUcQMC21ID:L9iIxuERzA83h09RZxYfHYLdS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4532-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4532-1280-0x0000000000400000-0x000000000040B000-memory.dmp

Download