Analysis
- max time kernel
150s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe
- Size 49KB
- Sample240616-e9kyaaterq
- SHA256 fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053
- MD5 64499c0e778a6491d7c49b6afe7d6bf9
- SHA1 c758d810ba9b8a97c662a8fd6b4a254b24c5f4cb
- SHA512 c30729f1004cdddb2030ac64934495a3c5012834bac2c67edbfd1778f5cc95fe5321371274f6ad3d77fa727efd1464beefbced229b380e9ce4e731160f3e5b8c
- SSDEEP 768:W7BlpNLpARFbhblkYlkuvIYFBEXBwzEXBwH:W7ZNLpApCZuvIYT
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp fa67ed3f39c21dbfead3346b05c5ce48b63162a19bd08bfe303ee0dab2472053.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
- Size 50KB
- SHA256 cf7ea1f46c7b72494699e52873eb8ec84a22b129d45d6368e5c39c34cb664bbe
- MD5 026ed4ca97d0f77f75c4c388927191c5
- SHA1 51c3847a0fca3d71832b6e2ef61da0f1cbef5432
- SHA512 b072466724e822a1aa58c96c115f2b01ed6b9abaf57bf9d240cc8cddfc4bfe4aff6364e2813ea4f6ca9bb82bdc44942c843a28a0110c211485d59acdec44042d
- SSDEEP 768:W7BlpNLpARFbhblkYlkuvIYFBEXBwzEXBw6:W7ZNLpApCZuvIYW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 148KB
- SHA256 ea7cb3e3bb827540201bd04243b848f6fb3e105fb00de82558e95f5628ec7454
- MD5 59e7da6a52b35ace2f89b542d337f80e
- SHA1 3483fb23c49f7bd74f108308a0166f35950e2f0e
- SHA512 a69d52d9551d776e44da68bdccd0dd525f8319df9cd9559e6dabe737c866ce0f3eb61d864f7444515693120fd7a4253835d1ed438196290105bd90890b6edecc
- SSDEEP 3072:6NLWpCZLYSWHIjN3tj6qnv0b2UrXkbvL9:u6SY1IjNDv0bNXkbvL9
- MD5 SHA1 SHA512 SSDEEP