Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe
- Size 92KB
- Sample240617-csentsthjq
- SHA256 cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927
- MD5 85c03a3eec86e52ff6dcf04db545439f
- SHA1 b90efa78f08c9128dc4f5e7f1596c48d458bf2af
- SHA512 e51d3b7f6a72cbd2c59e3ed43b51677c3e5e7c961c454f66aff24eb95c2bdb9811a7a01d60db288466cd21b7c38aa539b10ef2b07a2832286ca0a24deff5d4e5
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfxRfxHAu39Au3L:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7r
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4984) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\MergeDisable.vsd.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es-419.pak.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp cc14f5ff7c985f6a9c2960efe0ab11d1b4a2be3af58ddb5154d7217cd1a3e927.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp
- Size 93KB
- SHA256 2ea7c857da4787e239bca60b82f1caa0cfae18802d2301b56eed8cf72b93b65b
- MD5 835e5058579a6fd6609645aa98d57968
- SHA1 378e5cb6b1209bbb38607cd1c03bbd0be2339795
- SHA512 ebb9f07715ce059072399709782844747cac91100e9a7bfa75105f3c3a8575881d8faa4b861d593fac4a6a47804589a4fde7e9206856c998192dd770c850f413
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfxRfxHAu39Au3n:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 191KB
- SHA256 f4d6673029ca5cff015548b26f2bb45082e44ccd70f61d2ea88b47e7f4afa420
- MD5 62acbedcec27bbdc4193bceb98664ddd
- SHA1 2e7bf7922b2ce148d8226b9c2fa2dff67c4f670a
- SHA512 845cf7ccede491214911ab44424a73e51bbf240a7f206a8ce93643c60bc1d9e221acff3d0c55b4f51596b806043f6e4f116871311d8a7a7840cb36ea185eea88
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fpWHIjN3tj6qnv0b2UrXkbvLW:RqKvb0CYJ973e+eKZOf7feIjNDv0bNXX
- MD5 SHA1 SHA512 SSDEEP