Analysis
- max time kernel
150s - max time network
54s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe
- Size 75KB
- Sample240613-xdds7sxgra
- SHA256 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257
- MD5 b750e9337d03bb6a9c396950f39e3adb
- SHA1 294a11c1d32d14927bb9e7973bf5dafba56efb84
- SHA512 ee0e4ac02c25c169734535f5ccd72f89b44b2e570275c709804e5f438113a0f0cf8873be416cfea034b1bee28f0e5fccafc5643415de827777da0e39774e52d5
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJmI7:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFu
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5266) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGCORE.DLL.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSB.TTF.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYH.TTC.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CENTURY.TTF.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 0476c44439b6f72762a51d0cde9bb7258d41414c3773990b6f3df28ffaf72257.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 75KB
- SHA256 1122f5c08085d7ae14ef03705faa3f7f85918d7f904bbc108ad60a08d227fb82
- MD5 7ee9c2b5951628b632e26a74f44c2afe
- SHA1 fc4c63eae43bbbd8f4f3563731e356b401a2a3fe
- SHA512 74352955fb2d14bc1748ca833745c5b9bfd9c110aa1ff339c71688f39445f48ccfa1b7ad75ad1c76ece4fe10fad67618141cfb8d4a871886527fd7f17bfb08f6
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJmI6:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 174KB
- SHA256 29d00dff1e6e428cc9964f4f55eb33089aebf433dbd3501a26b9a7c8e9831e2d
- MD5 75ea4239488d465f2ffbba43b6737595
- SHA1 9d211dd63028ccb09756cb9c53938163a96bb3ab
- SHA512 2b51cbf6ed3f89c0012e27168d88b724eec5b5e747659900a98b402c3b606c496f0fe1ba03ae06f16af9982d4aecaf8895963e63ba19470c31c201e02ebd2437
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFpsJOfFpsJLWHIjN3tj6qnv0b2UrXkbvLC:RqKvb0CYJ973e+eKZNIjNDv0bNXkbvLC
- MD5 SHA1 SHA512 SSDEEP