Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 07:08
Behavioral task
behavioral1
Sample
fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe
- Size 189KB
- Sample240612-hyh64atepg
- SHA256 fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea
- MD5 8875f6100351eb5f1f2d253292d7a415
- SHA1 d1655f5f86dd8a0e4fe6464bca464c117136e87a
- SHA512 07141ba67df3b0d68b26f68dcf9448b096e3b6bfe9497a07b8d0eadac05f1b5e941e6e04b28313b450e61161d51db61b5fd06e7dde6c8f1f48163dd70034cb8b
- SSDEEP 3072:fnyiQSo1EZGtKgZGtK/PgtU1wAIuZAIup:KiQSo1EZGtKgZGtK/CAIuZAIup
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4829) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/2516-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0005000000023276-2.dat UPX behavioral2/files/0x0009000000022975-6.dat UPX behavioral2/memory/2516-1740-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2516-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0005000000023276-2.dat upx behavioral2/files/0x0009000000022975-6.dat upx behavioral2/memory/2516-1740-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\sw.txt.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\7-Zip\7z.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp fb3ff7d0d8f206c4d8345038881818a9531e7303793096cb5043aa89b213c6ea.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
- Size 190KB
- SHA256 f5c3e411ee1635509037c07b4bec1b7602183774338b0d5295acb92a9ad7cd35
- MD5 c3844b7aef3cea03d7f3186aec076ea8
- SHA1 30d668529bdd595150bade4542f1cee903d521da
- SHA512 c82a224f11dc3fcddfdb133471951d69ef52cb1c58feb051f507e182ce9dd49f6b0fe2c9462ca18c954a52699b8becce7f49a3d6b1fa749dfea0ba17a96f5a3d
- SSDEEP 3072:fnyiQSo1EZGtKgZGtK/PgtU1wAIuZAIu7:KiQSo1EZGtKgZGtK/CAIuZAIu7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 289KB
- SHA256 4d66bbf96763957e1ec1bdd90fa29206f8e0fdbe538759520054e0aa4368aaa4
- MD5 a99582823649744811c32a59d3054aee
- SHA1 1542041bf1a0ab979bac287fcbda665ee4b33b73
- SHA512 94c6fd658cd6b3cbfb2c925d498c07413e5acbf6cb5c314a1154951591cc4b4d33a1e16106e321981a02d6ebe1ea8fdbe5be2341ea79cc09c9bbff4c49fa3c9c
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIu6IjNDv0bNXkbvLi:VQtyZGtKgZGtK/CAIuZAIu6IZGNXkbvm
- MD5 SHA1 SHA512 SSDEEP