Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 04:18
Behavioral task
behavioral1
Sample
f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe
- Size 135KB
- Sample240617-exfssstfmb
- SHA256 f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54
- MD5 c0587c28548bf1702a0a5b519350446c
- SHA1 6901a27cbe3f261c58c4a821f5a79f0b9afb7432
- SHA512 7715a62ce7e9e6cc3e120ac665daf1e70f3d12256b4f1915d8a6bc554292261b10f7190ba2a993cbaadf5f3ff1e8462a61c7d8764c2b9cb931372d9224b0061a
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC4:fnymCAIuZAIuYSMjoqtMHfhf5Sskk
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5018) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/228-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0008000000022f51-2.dat UPX behavioral2/files/0x0009000000022979-6.dat UPX behavioral2/memory/228-1788-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/228-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/228-1788-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp f8aa103d9d9dcadf252ba50fd11a6d21b94289dc65a6ae7d8e73c0f661b0ac54.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 135KB
- SHA256 01ea0dfdb3e69c4a01167c84bb49a1d31050c2618f3358a7686324b9e8c6837a
- MD5 ba39e5d95991409cd51f90af229633f5
- SHA1 e4ec7ecdd3c2baa959ca7c0a9d30c9804f472472
- SHA512 a62478c847ae6fde1f3c3178201bd49377d60a839cdfab99461ee3e2b426dde9fae7b32d2e5c02dd5c45d074b8528d21b2bbf39422d81d8055c1e9fe4c5f1ca4
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCu:fnymCAIuZAIuYSMjoqtMHfhf5SskS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 234KB
- SHA256 29111eae5e163c865b42255f52d97c2e4bb927e7f5c1955c6472f95db0e7be34
- MD5 a62ae93104faf0a2cf742a4df893b945
- SHA1 d38bb161d5b4ab42c193ceeba5f1aac931163773
- SHA512 5a2ff17b18406f39ff7c7fd4c9931b144db4389211fe48664c9b5e964b53a10e82c0592f72ef88207749e7f5a8e5819e05d6cfb50ec8c262ed31e5412e2ed59b
- SSDEEP 6144:KmCAIuZAIuDMVtM/XSvIjNDv0bNXkbvLI:IAIuZAIuOYSvIZGNXkbvLI
- MD5 SHA1 SHA512 SSDEEP