Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe
- Size 94KB
- Sample240614-alj9maxcpd
- SHA256 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa
- MD5 1e42485ec8db07ed6764aa6f6080be62
- SHA1 a3f79caa8523bf82b72e00bcb6ad1e2b0e7b8cfa
- SHA512 b1b8b5bbcb1161310b1cb88ef253480f2596cb32157f0af5e38e0016bacfa3b2368f2644a77de37b616fcd55923630cd263cb739790c81954155fbc445d3e22e
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8EhS+:6rWpcOPxPke+e3fFpsJOfFpsJbgEZ
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5024) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp 7787e95e7a8e6970d0af27e26fac49755f18778c3c4788fce66ace0118ae66fa.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
- Size 94KB
- SHA256 f1ee5fd309c7f3a536659a5f7d86b4fe40806ca3cc9a992c399e043846ebffc3
- MD5 2fcb1675c8ec894576f128ceba5b75d2
- SHA1 71a677890a1aabd3505f645bb35bc9acd15c277d
- SHA512 ba72239c70603f259d2d39bf3a6056259cc24e1cd2d24a7fd18edae15583593e0e543eef55520435692915dcbd9c9007616f292952b391df8a4fd796203cd0f1
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8EhSQ:6rWpcOPxPke+e3fFpsJOfFpsJbgEr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 193KB
- SHA256 de35f6659eec5560edd54deac3e05371e78a164c791b72849d760ee3ca2c934c
- MD5 cfdd34720a2ab02bc386acab7a20aeba
- SHA1 94aacebbabb06bbdd70fe8bd70285dd8572bc2d3
- SHA512 05f5a3850371c827120fe56dc460cedeb9602ee77c45ac5a155316ffe0eb300716cd05979d0ca0746e1e876aca6af0dbb7f92d5771f5d39b9f0f2a19a4a5606f
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEXWHIjN3tj6qnv0b2UrXkbvL5:tFPxPke+eIsIjNDv0bNXkbvL5
- MD5 SHA1 SHA512 SSDEEP