Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe
- Size 66KB
- Sample240612-a2a1wswhpr
- SHA256 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f
- MD5 29b7d2b7acbd84d2918dab39ea4e9911
- SHA1 c24e42dd10ed4aa91ea93d2a86f6c582f00d2ee6
- SHA512 43eaf4662483f6d282ad5e27c29cf4dbc88bfa2ae5ab7d8a89e550608ce00faadd3dc071025d6a59f1f2635e5cb5631df56968a9c37a9bd5e0fe904a1457ca5f
- SSDEEP 768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhC7B7s:W7ZDpApYbWjIoPyPoLzV7c6ShL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5263) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEODBCI.DLL.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FREESCPT.TTF.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\7-Zip\7z.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jdk-1.8\release.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp 8c3dbeabb9f32b42d11e26fab4f54b21a018755636adefb123b43c28ccf0098f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 66KB
- SHA256 17f8c6b6cc046e1138314c7a3a6f303890b9b0bc3d20b0be78f87829ad1b6405
- MD5 ccf40b0ae9597bed3551bbefced63ca1
- SHA1 c7040a1a10686996af4e747e9a23232ebaeef70f
- SHA512 ba910d797893751538ceb93711203bc6db943848cb38f0a610ce4329ef40921f3898c1f5dc727932e69463323aa1ba0b023d127dad51b02d7ef0d5a787cb52a7
- SSDEEP 768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhC7B71:W7ZDpApYbWjIoPyPoLzV7c6ShW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 165KB
- SHA256 4cf2db43425b8f75f40f92291abc61ecce0a4b8e401177995075f45128291a5c
- MD5 feaf0d0b79d31913c02583d0612991f1
- SHA1 d9bc7c9806eda66e66ea5509f818e5e964d19a5f
- SHA512 b0e413a77dfdba19c5e4b65b56a448bb3fc89e5a074f3dadacf39714dc5b80add35e887c5f9cbfb3f8b2187bd7765e706782b154cab189eb2c0adc689cc8b1d8
- SSDEEP 1536:W7ZDpApYbWjIoPyPoLzV7c6ShF4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2F:6DWpNWHIjN3tj6qnv0b2UrXkbvLT
- MD5 SHA1 SHA512 SSDEEP