Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe
- Size 95KB
- Sample240617-ane3pavgkh
- SHA256 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a
- MD5 1aeac30ce763268bc10fd1cccd6ab653
- SHA1 2eb97ee872476df0c03e4ec947c13c201d6a13ed
- SHA512 ee820513d8e38a440f09a3195c5ed2db62af9b889d89b7d280bf72001510a3b4feb6c9773d1a5ed5d38aa13be545ac3d21bef73ec14a8b54a0923af9ec7c5c70
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8Ej0W:6rWpcOPxPke+e3fFpsJOfFpsJbgEr
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4863) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 9e0f02f8859542024f6e15a6ac800007da1782875ac6bd35fd37da9b6a65136a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini.tmp
- Size 95KB
- SHA256 8cd771d58f36560a0f8d41cea084fa79b636079ef6073b021fe8752c178ea728
- MD5 96a0d9733e5a4de0adfd298a30533339
- SHA1 34b09d6a0db4063b3420ac42375df406dddb2e51
- SHA512 b7fc1b87ddfddde546050ea45198ffe9b12edb533f475f73597dbb8c5a8b5cabd336b3b83ea763bb37f2268b86029a56043268993c31ef4291c8230562fe5591
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN8Ej0U:6rWpcOPxPke+e3fFpsJOfFpsJbgEV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 194KB
- SHA256 6268219d317d824606ed4a1e4058edb8aa19b9e634abb8fc7fc220de5f15544f
- MD5 1775f8c4426cd6682094f263695ebd63
- SHA1 cb45d86ef8a442026217e5ad1390ce59bcf296b8
- SHA512 00941d332a2d0603b153f7177da4e179229b329cc437851ee6c512e616918ed856ee579cacc3745b3b3d3750155ad260b5881c8968dc249aadb68d274f2fb979
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEYWHIjN3tj6qnv0b2UrXkbvL9:tFPxPke+eIDIjNDv0bNXkbvL9
- MD5 SHA1 SHA512 SSDEEP