Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe
- Size 93KB
- Sample240616-3gp9astcng
- SHA256 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc
- MD5 30cf13af20c807841f326305f82b5ba5
- SHA1 b68f58e66765ea7f16215ac5c5143eb86105734f
- SHA512 f1633850b90f77a8c48542c7ff6d3830165a6630b194fb1ea4e6c9328cd250249f2a1a8116733bb9113a1df77b406400f1466d5c464ade1641e1224b5205ab69
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfxRfxHAu39Au34fffi:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7N
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jre8\lib\deployment.config.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp 88178d8f7aefc44e91a6ef0b0dab54bb9a62d9f535eb9a64fb9d3143bdd9e9bc.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp
- Size 93KB
- SHA256 a54cc187793f174988b4345f9c291f16956ee1778c5a9ae22d37cb1bd1fa84fa
- MD5 6604f9138f9beef0814489d70d2dcb67
- SHA1 e1997599224a3f2d909762d2e7166c722c937cbb
- SHA512 4876773e3a950a20865b960b4efd53af3ef7550034b692288867e64dcd045f25f106e1a0c7c56fb4a1f874b4e9e8666a277db6787481af8f6c0193fac39d47f2
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfxRfxHAu39Au34fffA:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 192KB
- SHA256 d64f0627525ba7c74384fd94d42978edcf1fe679802883712fa0a67e73812007
- MD5 f98f0816309db2219ec3ffd5e6f43c25
- SHA1 c481477de9295dcf480435e602552f23d6d722a0
- SHA512 d60719621ed08ed185af8acc977963472134d40b2f0f76c2be637f5108c9f460571db1d22d43a27bc2188cbe4a5ee21f76ef4ff4b11833a2fd88b56c91943af5
- SSDEEP 6144:RqKvb0CYJ973e+eKZOf7fAIjNDv0bNXkbvLh:vvbxYX7ZNIZGNXkbvLh
- MD5 SHA1 SHA512 SSDEEP