Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe
-
Size
57KB
-
MD5
41a91e8b0d16b3ba76bc4bbfcdbaf5d0
-
SHA1
00a37dd93b32a73915e51edff09646fda0ad219a
-
SHA256
d70f4042e200fb4439effc4809c2374dca3f896e2a4c6c28d2b1659f01ce113e
-
SHA512
f642f060c8f799fa9431ef2692f162f7bcc6219c6eb7310dadc93e1553593813cf4c2e4f58d0027fead92aae0313ae9d1edea5c1be183a52feecf27d3131db5a
-
SSDEEP
768:W7BlpppARFbhwEnAAJ+AAJ3LnmJARJA3WzWiXxX2oV0OiJfoV0OiJ0o4oM:W7ZppApwEwnmJARJAaXxXHJAHM
Score
9/10
Malware Config
Signatures
-
Renames multiple (5038) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp 41a91e8b0d16b3ba76bc4bbfcdbaf5d0N.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5b592120a6b05a0ba8ca77129a6d6088b
SHA1021e7fdf68771e82a2b88d94dfb5b30f1c0eba0a
SHA2560460187d6d83140135f3bc0525adad344504146d639ea9fcab372a83e9b71de9
SHA512dca193f9310f83d4a7fc8d7ac3fe45585b23facc8a9d11b498e456250fa09fd69507738ebdabce43093b9c9317c8540477a15580a045e18958c5f8a1aeb74724
-
Filesize
156KB
MD5102f23c424f47d593145c663be3b95f7
SHA17c20ca5dabb8e1768ecf6a939f22ddd2ad214d47
SHA256742aa6b6d866d5b5f3f76d8e2bcb913bda2abc9efe0e4f657e41a942c4b60bee
SHA512c5f4bf0c7d2bf8fb19556edb3e96675c2dae96cc8bfa6293ad847c60f9a33f01463f7ddc464b70790165ad4317d0e31b4a2111cc64205f8fdc762fd95fc639b7