Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe
- Size 97KB
- Sample240615-bd3xfatcld
- SHA256 b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967
- MD5 c563f173ad3a903fc502e110e003d881
- SHA1 fe9f9b5e9da41db22c48d298e0e030045ecf51da
- SHA512 461ee13b736c2dd211d8959e091d0e61eab301d34b7a1834a7b8c9c39296c5fcfbe6272ef41f678aadbf916e84171336357e19bba6f738040aabb7a14413b58e
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPX4g:6rWpcOPxPke+e3fFpsJOfFpsJbgE1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5089) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jre8\lib\deployment.config.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp b2899b211325ae4fb67f46e38239033fba4214d5d16b93e60f829b2dff3de967.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 97KB
- SHA256 1039ef5d5e324e1edc4e2af923564ce41f648ef5982ce71847664ba0358ba6ea
- MD5 f248bd37022a1b8893b07c1b43a02324
- SHA1 b3f17ed4d532ffd0bda198cb833ba4b67e1e75d1
- SHA512 63c4ab2624e3c7bd839726faa8c810933e24b1b0dc9b60e45db45d026fbe35a100cb549524b02b0ef3214e44e566535e21d6b69402c30a88bc4b5f292db35ee7
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPX4X:6rWpcOPxPke+e3fFpsJOfFpsJbgEC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 196KB
- SHA256 1aa0738d472ff31ffc14f0c4a678381cd4e550322127db8987e51886518df14d
- MD5 ee2e54362a0d86359b5ffbc4cd7664f3
- SHA1 17908a41d78af4799c62dece8ea64e8961b3440a
- SHA512 8a20cfd93fe7ffdb35484cebdb2609d6b2e1cdc088f6fddcaeea97c3600c491b08e17a0f374725c0a9e116d4e54475925974dec3423069a46985d10033afe4e5
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEeWHIjN3tj6qnv0b2UrXkbvLN:tFPxPke+eIZIjNDv0bNXkbvLN
- MD5 SHA1 SHA512 SSDEEP