Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe
- Size 81KB
- Sample240613-2pbkfatdle
- SHA256 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670
- MD5 ffc81a65219b88fb8bb7b1dc50d8439f
- SHA1 224989207fb254841db6f92706f476e762a7ba03
- SHA512 3fc4b2cdae1f52c5dfafd548266489be8854f4ff9827b7a7161f8324376a1e7abb0b1c86a094d336dd15a1fe5e0d4fe9bbe7f121393a53aeacfab3b2b8836c03
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZavv7G7R:6DWpwE7oL2e+efZwZ3
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CENTURY.TTF.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp 50097380b22d9bd07af5b830fa875eb2a0e9f0888a2a1194ef1a1dbea4449670.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 81KB
- SHA256 ecfe5e1cddc11b0571e7d57a66e22607d93e9da7810cc040144de1759830dcde
- MD5 047cb1234213b951c89e4a513a1a2465
- SHA1 46cf1fcdee9dd150efd25b9ca07a74676503440f
- SHA512 54c240f8fcc7f78d203df32358b9eba64771c0b704cb16c8707749b613728693508d90b261a27e29575a34178648ffd20b15918e488ce0ec4a767d5dbf496b1f
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZavv7G7s:6DWpwE7oL2e+efZwZi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 180KB
- SHA256 fd22c54fddb0cb5f162f1772cf995d3453e1d1d19de35ca473ed511017d9611c
- MD5 5daa2b28e4ee55326a684ce34de9b50a
- SHA1 fecadfc64583b62c0d99ad95f9d88ea24f620a4b
- SHA512 ec5008e0b97ea235edf95cf9ddbd40e291093a6bc118bdd53e30780f690d63b5dcf15f638b694516db30b5495b692bfcf77af3446667f16075bf3760b90ce5df
- SSDEEP 3072:6DWpwE7oL2e+efZwZ4WHIjN3tj6qnv0b2UrXkbvLa:dN/e+efiVIjNDv0bNXkbvLa
- MD5 SHA1 SHA512 SSDEEP