Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe
- Size 46KB
- Sample240615-ek3rssycne
- SHA256 f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5
- MD5 79dc0266cd9e2b226cb4c7cdf6d9f83e
- SHA1 b1879d26454cd3ed4dc005915079a378a7144615
- SHA512 db0168813c67938967d81ede20283ace276db3cf7d87f5e75130af3d67c3a5ab1f5f4d0e61f4b9386568045b2f5d2a70e8706861a03ac661e12f0b920ca9bad9
- SSDEEP 192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vh7m/FJHo7m/FJH8wf5Fi5F7l:yBs7Br5xjL8AgA71FbhvhwfzizR
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5355) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEODBCI.DLL.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Java\jre-1.8\bin\java.dll.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp f98d070e52b45fa2b98300740aa9b9e687af6ed214f74ead129c7208959d4af5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 46KB
- SHA256 c2bf482dcedc9d7f659a6bd5b02817a4bf6b4183df02f2f65fbae1b0efa0e6b7
- MD5 dd4d1cf2e318ba324c4fa3e643d6b176
- SHA1 915093706b9d876d714b31a968fee65dbfe9d16f
- SHA512 ea5a897600778281f90b4535c7060cd0fb6a4559897fbb3e3f34942efa067831df92829fbfc08c61b5683aeac7e3de02639c6fc1c19f9b5a347bf58dd56b7f3a
- SSDEEP 192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vh7m/FJHo7m/FJH8wf5Fi5F70:yBs7Br5xjL8AgA71FbhvhwfzizY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 145KB
- SHA256 9e9970f83d0579d91b3ff44e99f517fe8959006a69733bbaca215135e3b299c5
- MD5 834095e45604d7b0f93da7567c925a0c
- SHA1 dd9caf8d6b005ebe20f68995183920448f48b77c
- SHA512 7a170a3084f6dda7d1a1527aebf81ca927e9c9770d228c08508adc0bbcdbd7b7034c7c1fef249222459e6ad8d4bf0f7f44f62685660e3fbb2fa9a40c3e5beb35
- SSDEEP 1536:/7ZQpAp44pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DdH:9QWpzWHIjN3tj6qnv0b2UrXkbvLp
- MD5 SHA1 SHA512 SSDEEP