Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe
-
Size
36KB
-
MD5
d0f580f6a74ac2b78525790d11a757a3
-
SHA1
6892f38e99e3c349e3ff922bc3bff0d9fe6b3746
-
SHA256
04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77
-
SHA512
548840f333d7af1e802bfa5c7709545d63cb5857a4781f1b284ee16db34610e8b49b3f50dcd6943e2939eab86c2e3ad4516d7169cb58f0453ef3c40e19089599
-
SSDEEP
384:GBt7Br5xjL9AgA71Fbhv7bhvo42L5FgAytBpR42L5FgAytBpyiAi2:W7BlpppARFbhjbhg42LcfpR42LcfpQ
Score
9/10
Malware Config
Signatures
-
Renames multiple (5283) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\7-Zip\descript.ion.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGCORE.DLL.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp 04b9149266df61109df391fd2ce911100b88656899f5e44abef9b59b7a5f7d77.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5a7b98a0117a4515c25d5ae66d80b2aba
SHA121978c9e703d9408c1758b2b48b5ad16b03fcdd2
SHA256bdce051f4f3770c36bcedbaa665ac96398a0f61ec492e125badf6e1335219903
SHA512fc38f1443ac89c25c15ba93ee6fead378cd4c66e542dcec7a84b60d235604fe9657553c75d98bc374356832ad6117c5a994e3e1d78cf2d14aebe5ca082ac4b08
-
Filesize
135KB
MD599b0a1d6cb8e38ce97610cd68b2b736b
SHA1cc3b7dd30e3cdb8f3b509cc716d136a7812bad76
SHA2566aac59f31b06fb4037501dd717634174653c23eb2864727b98cb39d8e213c964
SHA512144d394dc5a76e9ade2ce68f9840b80cebfee3afac6d412d300331457919868f2bd1b8ca4652a6ded6874748bb4cba5722e275601c1e92fcfa293b28994acb16