Analysis
- max time kernel
150s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe
- Size 97KB
- Sample240615-efjs5aybng
- SHA256 f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e
- MD5 7e8da6cfac73b8ece1b3413daf8db5c7
- SHA1 ea782db8a48ba28dd994d1822dd25b563da64044
- SHA512 76168cdcdf9379fb26cc44a14b4b2e116af3b74846dc528915864e46a96a45c73fca55d972e48064d5d1bf50b0cb69b699cfcdf960672742ff7500e7c9fe94a0
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPX4k:6rWpcOPxPke+e3fFpsJOfFpsJbgER
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp f655cfd47256e4a76939f2df5c4cdef2159d04ce53d7cab89946fcaca2b22a9e.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp
- Size 97KB
- SHA256 bbf2c0f7527e6a92f858662a9d25501e26409c448d6ba34398176844b55dd004
- MD5 bc1ec8589291bcd93d5a933e5f4c4518
- SHA1 ab80e5b54f6b7c1acdd0d24bfdeedfb9dcc5a2c3
- SHA512 379ee0db5d3bad06ddf170d6da5fb2a4f07dd3a2c7d8cf0242874045ec6397f8b6b039174718b4e58220c366123d82db2a312077e21c564d3f8449bdd46e462e
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPX4K:6rWpcOPxPke+e3fFpsJOfFpsJbgEn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 196KB
- SHA256 008dad388c68f735134052e02e563e3c2f60adeff9a702adfca8b3a8f7ed060c
- MD5 757314b14da61b7c5b0d5135739f8995
- SHA1 12d2ee08f1f6903fefb399a0fcd1818ed9ce647c
- SHA512 d02feb2d9bd8544edb68e0dfbeba9137395ae6945846ad594b4d7fc0f95ccb841fba6c105f856dee1ec717721a92d35893d942f2112eb11eeb94d0e43f627709
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgE9WHIjN3tj6qnv0b2UrXkbvLN:tFPxPke+eI6IjNDv0bNXkbvLN
- MD5 SHA1 SHA512 SSDEEP