Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe
- Size 371KB
- Sample240612-edkyeazfpl
- SHA256 c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660
- MD5 0e7a81c7fa1a017a40b49eada7c2393b
- SHA1 9931afb0ce8dd71f5da23eda24235484c847c593
- SHA512 4dbed91772cefb4ccdade16bdc8c0b6b23b4ae2e8af4e97fe85e2082aaedfc2e07f4f7d7cdefc306f152ceba487f1327f4173674844342038080d1bc28b0008e
- SSDEEP 6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtFVHPyvewDpgskuB:3PxPir9RyiIuGcKbpaSL4vtFVHPyvewL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-PT.pak.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp c0bda73792491d20438473a5d620d4ffc38fb11c97e728ff2e25933422649660.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 371KB
- SHA256 0c29781e3fdd74e479036a1b598a7663e0be41621ccc0fc2700031e3627e14fc
- MD5 9869163f0b027be720bc6b8d40be6957
- SHA1 9452e5ac6105a11727749bd77387f4ef9176226a
- SHA512 89cf8590745c7d6ae347a2bced1dbd5a8e2bc5843b637dfc744bc66b779edd8c212230585549e8a6dde6914554cce53dcf0ca768fe9b8c196e40809a78b7bda8
- SSDEEP 6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtFVHPyvewDpgskum:3PxPir9RyiIuGcKbpaSL4vtFVHPyvewE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 470KB
- SHA256 c794b5f080ce885f09fe8410ebda560f0569c8980d6925927a67d67c4fbec44e
- MD5 01010485b83d96485c472e658a963621
- SHA1 77db7d3c1b631716360f058c8f82b732fb3f04ff
- SHA512 0ada327779200d381b55b2d9862060a133851a2f68d0f70bd8705cca3683b2ed11adc9e91bedc120cb0e9d0ac2a5a7af5cfd52a09e1c51988b13034bc487f0f6
- SSDEEP 12288:3PxPir9RyiIuGcKbpaSL4vtFVHPyvewDguBIZGNXkbvLG:3PxPiRRyisBpaSsvtbaIZaXkbv6
- MD5 SHA1 SHA512 SSDEEP