Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
06/07/2024, 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f06964b4c1cc6a163135618fe2b3510.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f06964b4c1cc6a163135618fe2b3510.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 3f06964b4c1cc6a163135618fe2b3510.exe
- Size 52KB
- Sample240706-erqqtavfpr
- SHA256 d81f27a43b773757fc9677b41a2aec43efbcb10deb185c2190443249efa077a3
- MD5 3f06964b4c1cc6a163135618fe2b3510
- SHA1 4534c6a8acca3d98a655b7b31c83f0581c737756
- SHA512 e413b5e8322d55542c650943f8a9bce9daa1500b8bf0b124371e9f058648e93e9527e8aaf10bbdda89cb2fc084738ac5625807b0ae334bf6e4b00331816e112a
- SSDEEP 768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwg:W7ZppAp0
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4867) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\nacl_irt_x86_64.nexe.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\LICENSE.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 3f06964b4c1cc6a163135618fe2b3510.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2480455240-981575606-1030659066-1000\desktop.ini.tmp
- Size 52KB
- SHA256 e80390800cab0234564f0417abf909478f2ffe16aa552637ab6d82ecb7a09fa5
- MD5 f71713aadf322e418226b790cdbdd0db
- SHA1 11f9c87d676f42350bb4f0c20ffe831c970ee032
- SHA512 ad1df4b25c6a4f45be90583918fb853a12f16b964409d70cdac2485baacf55d7660143781f417da8f5c676322c9b975e5677d0b67eda6990f586d00f8e85282e
- SSDEEP 768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwU:W7ZppApo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 151KB
- SHA256 36c9c6eecfa435c5a63f3095cbae71a2f9e4a07d0076579c912885c183754906
- MD5 aae7e3c12faf0003c8e529b89f160ad2
- SHA1 87918f7bdf2ef789b89e0adeb85106ad6d8f1dcf
- SHA512 759185c07dae9fb5507171662911d56794c2d8a753017465598fccfd3c3a96cebc2d786c1a23fd7cddfa47d2161f6673e3854c1ce3083300b26e50b96710a8cb
- SSDEEP 1536:W7ZppApo4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddj:6pWpDWHIjN3tj6qnv0b2UrXkbvL9
- MD5 SHA1 SHA512 SSDEEP