Analysis
- max time kernel
149s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe
- Size 62KB
- Sample240614-2d6ansydrc
- SHA256 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152
- MD5 f3166e0709a605b1fbb98c5fd578fcdc
- SHA1 64d3575a88684f2df74f04374e90c8c56b3a098e
- SHA512 e8db282bdb04a577a77c2d285d36281a73003804f96d8f2c85fdc4b7f9167175dab74d131eb586e6cf4da54767073e2209b2f8341ec65719e0d430b498cfd12b
- SSDEEP 768:W7BlpNLpARFbhblkYlkuvIYFR27K8WKnFIMK8WKnFIhEXBwzEXBw/M:W7ZNLpApCZuvIY0KNKnF3KNKnFv
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp 6d8da057b6391de9382dfc9dd635b38321af2dc42748c73f0dd4e3f25909a152.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
- Size 63KB
- SHA256 017ebf80bc3467129106edc99e27837f72bf1e6331264ca4bbe5453abb7fd9ba
- MD5 adf2e4b1a2572e698a8461687a005603
- SHA1 ffa0fe2210b40dae2b695ba383679ef42253089e
- SHA512 1cebf2f3654dd44b6616b15da0aaad5f48e9f8dca80af374051a3abc7741cdc4b450ab3622da34531d1343c1f5ee14b4598d3f6ea946566332ed60f55a737b61
- SSDEEP 768:W7BlpNLpARFbhblkYlkuvIYFR27K8WKnFIMK8WKnFIhEXBwzEXBw/s:W7ZNLpApCZuvIY0KNKnF3KNKnFj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 161KB
- SHA256 fae104521d8b8fd010059774f224121c8e8862bb3381bcc6bb3cdb75063f7a08
- MD5 03e309311d02ca5f77c732c0a5752114
- SHA1 0bfb336a50f8ad1b822385fbc476bb23be5c4e22
- SHA512 e7404a35e257678c2ea98a58da6896f8703dc4e6cafaa8ee129445914bb004f2f614e7bc65fa31d666246d6779db2b72448d72f15b7b5a6fff39ac7c9360d636
- SSDEEP 3072:6NLWpCZLY0KNKnF3KNKnF4WHIjN3tj6qnv0b2UrXkbvLN:u6SY0KNKnF3KNKnFjIjNDv0bNXkbvLN
- MD5 SHA1 SHA512 SSDEEP