Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe
Resource
win10v2004-20240611-en
General
-
Target
cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe
-
Size
80KB
-
MD5
2c6d95e62b3ec8a599041a4b3b6c4157
-
SHA1
06142afbd5373076cfd8d625123eaf396a1dd81c
-
SHA256
cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e
-
SHA512
2090fa4fa82ad28014b239e29748b9bfce96e0898d09177552ae834ff2196a71a6a348502edb39f53106e78ce39e7ff1dad17aafe7966b91a51ba46a9452075c
-
SSDEEP
768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hH/:W7ZDpApYbWjIlE77ufL2e+efZwZav7
Malware Config
Signatures
-
Renames multiple (4866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exedescription ioc process File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe"C:\Users\Admin\AppData\Local\Temp\cd1724da06d3def9258e7e40f4e92ecc7cd1750f0cb5d21abeb971dbdd2b035e.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4452,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmpFilesize
80KB
MD5c01d34c36ee62c90cd22dd951d969d07
SHA1719d15f6d44e74ee6ffe98952e301b59b5ac0868
SHA25694ed3ddce94de9fd1fcc4a4e0e5d5d0f5c402dce5ea379a60b52e0be9f9fd696
SHA51291a086c9d6998028fb2d40761d0f3cb3562c9fc83f82913d0256c80376a0cf7182a1c5930dbd54c83367b13882929784f38f3d67a3364876e340a68bba8eaaec
-
C:\Program Files\7-Zip\7-zip.chm.tmpFilesize
192KB
MD5bd9c8c2a463be9798066a7b3a0bcd78a
SHA156a96f3cc43f26e8cc1d5f9761110deec87b8bbc
SHA256c9facf568770fb772a6d0e869c34b0da3b5c9ed9ec6bbbf7ac252fe244e25b68
SHA512bf55c7c0a9cb3bdc31891151f95be045b6cf708d09fb4ccf482bf893c414083dd89bc3a58583ffd3dcce307114e2d47cd93411bca2490f6f43619b506da4cf52