Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 19:00
Behavioral task
behavioral1
Sample
1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe
- Size 75KB
- Sample240614-xnnfdswerp
- SHA256 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736
- MD5 2ac1b858727ead169ebb3eba6073d270
- SHA1 760e403b3fafe219437d9985f974c0f59b960363
- SHA512 30e14c701ce700e776de4c15253fa5257e71b57084e31ed3c5de355d4cdf6402f48d765b0d52b456c0885de79b9a34c979f5b08897d039c9019d63956f57fda1
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8OySUw:fnyiQSonySUw
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1756-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0008000000022f51-2.dat UPX behavioral2/files/0x00090000000233e8-6.dat UPX behavioral2/memory/1756-1954-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/1756-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x00090000000233e8-6.dat upx behavioral2/memory/1756-1954-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoDev.png.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jre8\lib\deployment.config.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARAIT.TTF.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp 1492038a0c1e3bf49f409ab95a38deec9cffa67e62974b25a658917bb3c94736.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 76KB
- SHA256 503da583da7eff082ef1dca9bbf72df990cf353189a2c277c4eda4342cc053fa
- MD5 37454419a0d1248b01f3c3ae42951f6b
- SHA1 f25c396e7865c8e0f653822eb0eae71cd25e7dc8
- SHA512 7d7cbc66628092ce9257a32bf30b03269edd7c3334e7a0728c5887aa03b4a263612176d4f524c961252214d903a415f40e8161edde9a01b303d915692290e4da
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8OySU/:fnyiQSonySU/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 174KB
- SHA256 eb762830e2167244e2039cdfc5b8d32dea4f5b48d3fca81a9516caefa7f6d1ea
- MD5 72ddee65c5e001181b4d8a490a9eed7d
- SHA1 5fe3bd883dc5e43757937b8f7d41123c265d9e3a
- SHA512 b7b57abf70b0646641818252f76ca41ae0c1c686164a4d779a1e5034db7c7d6c2b07b3c1497091dcc9d2dcb41b89d6690e29e7b1349b40d68e89f9d036f3c9de
- SSDEEP 3072:fnyiQSonySURWHIjN3tj6qnv0b2UrXkbvL+:KiQSonySUGIjNDv0bNXkbvL+
- MD5 SHA1 SHA512 SSDEEP