Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 00:32
Behavioral task
behavioral1
Sample
a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe
- Size 138KB
- Sample240617-av41dswape
- SHA256 a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496
- MD5 aad406cb67865f9bae3379bd6a9cac41
- SHA1 c108cf87600fadc5ee065e361657f9348ce83eea
- SHA512 40bb0c496c5d3475abeffe9e8da64101fda2456b2c9ddfc3518a4d0f9a1f538ecb87eb0560a7821e2f5301356032d9c852d3846a9bff9533e9537eebc7df63e8
- SSDEEP 3072:fnymCAIuZAIuYSMjoqtMHfhf5SskoZ/D5zf6ydyf+abMkF24kzK3jbrCkoRWNkzr:KmCAIuZAIuDMVtM/XSo
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4979) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4980-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x00090000000233f8-2.dat UPX behavioral2/files/0x0008000000022970-6.dat UPX behavioral2/memory/4980-1793-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4980-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000233f8-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/4980-1793-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp a2d6e609e5c5922a2c08ed83c4180100e3b7b7198e94aee7172e7543637c8496.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 138KB
- SHA256 d83c66ea832674cc2eb3b9a9303eb2de05360b99a5be26d151df40c1371597e7
- MD5 e981705c510f05bf088f91c277ef5991
- SHA1 bdbd49efabdf1eee28127ffbfba4dc767e0be314
- SHA512 393ec3e345e8fef08767020321bd45179ef76d6d9d95feb6f8bfc09af499c1d9d8715f618ce569033f687b573f65ac340d82586211585ef54cd8c2d55c1c7f3d
- SSDEEP 3072:fnymCAIuZAIuYSMjoqtMHfhf5SskoZ/D5zf6ydyf+abMkF24kzK3jbrCkoRWNkzJ:KmCAIuZAIuDMVtM/XSu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 237KB
- SHA256 867f7230a9af995b9043d3b902b93df921c0d15992afde492b8adce09ca929da
- MD5 1319a390d5e4be2b446f9dffb8ede4f2
- SHA1 aa1c12a2d36509166dfd1aca2dca4d597c5b9476
- SHA512 e4ae2ff89788d705de09632cbe3ad41d2b251202d9dfd842f6a75d52fd14b8129efe2db6582b727295067324bd0283e70641abb8b209ec0ca85319cd776099b1
- SSDEEP 6144:KmCAIuZAIuDMVtM/XS+IjNDv0bNXkbvL7:IAIuZAIuOYS+IZGNXkbvL7
- MD5 SHA1 SHA512 SSDEEP