9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
Size

40KB
MD5

573f9701a093efbd5790d731581d0e5a
SHA1

7c6c8236636a033794a5462da318718da3c2b064
SHA256

9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4
SHA512

99f63841fe8e6975cae72bfde68ffdb11ec41bcf65ea5bb2c53cd1494ee3c7d50a880a146b14f20185d611f0ee0c8da6e906831f2441362f5ddf5f0219219640
SSDEEP

768:W7BlpppARFbhbt7Y7FoICOiJfoICOiJQ444Zql:W7ZppApWmjXL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe

C:\Users\Admin\AppData\Local\Temp\9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe
"C:\Users\Admin\AppData\Local\Temp\9397c30b9b1d0e1f384b91f39e943309e54ef743eeb1f29257b7c097b48fd2f4.exe"
1⤵
- Drops file in Program Files directory
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
41KB

MD5
2c68319878d6b4ba49c9962eae7b5be6

SHA1
d83c6450d163e437521aa72158457f8ac5e54e55

SHA256
2f8c77cc133852ba599fc612d5659de097e39d2336d39021d316044a289c4bff

SHA512
ba08dfcd1380fd46077c2b543721bc76bd3814c4b68c664051d3dbe1556963ba7da8a1324a2ca1eb0a9537d7705b114fae14d8f86efc61f75249b402a4f8808d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
153KB

MD5
063261f19240c054828743578c424258

SHA1
90fb8f4b5d8c6c9a9fcb9c2c4693f9562e5fb61d

SHA256
d43e9bd91ae4adbbf8828f201af093fc178d191c3e52311760035ceaa32a4437

SHA512
e364e1b6547cd709a20bbaee34ed0732aa40ac76acd3d80e17e3980ff1489eb4b8711c834c85bbaaa42006f3001f72f8d75c1527fd02eded33366d9560f4ce7c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads