Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe
- Size 52KB
- Sample240615-efbshssbmn
- SHA256 f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2
- MD5 faf538e938451ae60aed703d2e6a8366
- SHA1 3a59b4169ebcc4ad9d93467065bbcda5409c8512
- SHA512 60f67e328ad4192d250d718650d6546de9834669c1a40450b98b6d02f6df6293e8430be6bf23ffe973c5f161bbf084be921d86e1c2dfe3ddb58484c11f87f41f
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvhwfziz675P5Zrf5P5z:/7BlpQpARFbhWGs5P5Zr5P5z
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\eo.txt.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-multibyte-l1-1-0.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.GIF.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\msointl30.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACECORE.DLL.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp f5ef60b3fc3f54e43d6ed95c22ad32806559a91571135ebf383a0cde2ebbbdc2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 52KB
- SHA256 8f21a7dacd4b7c020bfe28568dbb2bb9bf28b99ff88f2b01e23ffdc3626cb085
- MD5 c720aea56e179a2af516aa19e4bd4246
- SHA1 e2d788e9ee47a7a5c0392ddf4c78af46d10b5566
- SHA512 9fa0d2219f7a549daea8085fe53afda165df9153447c9dcbdf91420c3e725d8882dc19edd02be3435d53db051b81b5ae6bbab5b8f6f94ea41dd4f838c15796a7
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvhwfziz675P5Zrf5P5A:/7BlpQpARFbhWGs5P5Zr5P5A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 151KB
- SHA256 ac38ac4820693844a31c579502ca78937e211d894da87dd96963c10429510845
- MD5 76a3a89e2d41ed1051467677882226e5
- SHA1 17ae71acefa4707c78c50365b7afd3bfccb5b45c
- SHA512 876cda1a6012efdd0c5fc8fae8c3525edc21b5eb5032fd8e64e2118ee7b0d33c29a90352547aa90375d264a7ea4d731ea6214b9d3de0164e76f93b69113aeefa
- SSDEEP 1536:/7ZQpApQn4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddn:9QWpQ+WHIjN3tj6qnv0b2UrXkbvLp
- MD5 SHA1 SHA512 SSDEEP