Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe
- Size 96KB
- Sample240615-ae26vssang
- SHA256 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14
- MD5 0b04d630891027ee6e9e30530e58a828
- SHA1 3b30895dddbb146374f9f69bbaab5f1838aa837b
- SHA512 73337d6eb247eba226de96a4a806cec0d244f04ae5447ab498e643a292ac0f636a2b345b3ca72c26da117d537a9363c5569750ee56c8c7083ef0c98dd46b2c19
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBX:PqFF2Ie+effy1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5021) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\AddOptimize.aiff.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxbgt.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\ExpandResume.odt.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp 9cb2a168e5a0f6192f113bc167eb902f73016cfe12187e4ac9177485a6310f14.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp
- Size 97KB
- SHA256 911f3135dad45d098f24cfc48d3c83bdaf81e2c0e850ff9ca9ab0f99372f8a72
- MD5 6962e8d9612b3359098544b54f76d5cd
- SHA1 a8f4405c8b52610e437fe43df1786bda860da5b1
- SHA512 6fea62fca9c2a691a4f26a6fd52921aa2f263c4aee27faca5d40794bd3f94347f9aaa54e7b09af13dbf532d548a2528bb6903a502a81f51ab8f471395ab93683
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBe:PqFF2Ie+effyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 195KB
- SHA256 350b34911976e041a1fc2e387071ef092e91d6739cbd6e2c4c5c10530c0274c4
- MD5 8f10d74e19ddbaee98836f7b7ac4c604
- SHA1 ef4238aa9d609f78952f544574aa2936d0159d0e
- SHA512 1e46908f12d8548ddee5db698d838923dc5b4aab4fd7992db9e298b75dc7ae353f4b3353dc9cb20f9cbf03465e085d94c17b096e8a71521a06909155ff6cd9bd
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBa:PqFF2Ie+effy3IjNDv0bNXkbvLV
- MD5 SHA1 SHA512 SSDEEP