Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 03:53
Behavioral task
behavioral1
Sample
c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe
- Size 70KB
- Sample240612-ef3agazgmf
- SHA256 c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01
- MD5 396b716efe9ace4fd6e6395e338bed20
- SHA1 e8a4d4ff132e3ca21fa65285aabcfc4bf5752814
- SHA512 c76003d27b0204709574c09daa20bef19ae65879a4fbc314a779e7ac33fd478508a16190c42439ba739e97b7e4efd09801e9373ab1589455ca90a2587f22154c
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXP:a7ZyqaFAlsr1++PJHJXFAIuZAIuk
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/2176-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000600000002326f-2.dat UPX behavioral2/files/0x0009000000022975-6.dat UPX behavioral2/memory/2176-1964-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2176-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000600000002326f-2.dat upx behavioral2/files/0x0009000000022975-6.dat upx behavioral2/memory/2176-1964-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp c2897a021c3b75df5138815d5d372d0390125ee9ab104ececdbc45a7672bba01.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
- Size 70KB
- SHA256 c212ed40497aba27432054f879ef75389c7e1e957725affa397b749ba6a587f3
- MD5 e868edb8207f92ed1dd7208b5c4a4223
- SHA1 b6ac590227194e79ea38f5a69cb7914caf9d360d
- SHA512 12b2c244eb996d784c229486e5cf25cc8ac232f8af78d1ed7ac9855f04f2e4dae4faa1037b2fe989fa422437fb408f6575ddd450ee47758fc4a3997f0e17da66
- SSDEEP 768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXT:a7ZyqaFAlsr1++PJHJXFAIuZAIuQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 169KB
- SHA256 0a7b1c392ef990af8e9a097ed44ffb0140faa7e58c7edce49ba92d9be758ec9b
- MD5 b3921927024d7f5d28f4549c9c2a4831
- SHA1 5fcfcf7fd9560dcd0e2b8190e6d7a6136a279975
- SHA512 2756aebf01e47bfd7b4c65b9833bd98dddaeb72fcbbd41eba222a9dcd534686c07260ecd7b96770682b6760f5593052ca4a6c893faf1e3c9002523272cf310d9
- SSDEEP 3072:enaym3AIuZAIuUWHIjN3tj6qnv0b2UrXkbvLq:wHm3AIuZAIu3IjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP