Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 21:31
Behavioral task
behavioral1
Sample
0c324f1b804a061897959ddecac28190N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
0c324f1b804a061897959ddecac28190N.exe
Resource
win10v2004-20240709-en
General
-
Target
0c324f1b804a061897959ddecac28190N.exe
-
Size
68KB
-
MD5
0c324f1b804a061897959ddecac28190
-
SHA1
97902fcf1a4e01f5fb045442b61906a9ca2de634
-
SHA256
522be1690277a9305f2817f75bd3ff78139d928160ddc74e950f38d2a5964ba8
-
SHA512
c8755286eceb678c11cdcc5561d12e7597a0cae77ea72b6658317ee684daaea1fa309de5d99b8dbc35a3a252c2319b9718d97a28eecc810c021bddd0c3c53295
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxviYiaEF:KQSo4iYiX
Malware Config
Signatures
-
Renames multiple (4620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1036-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00080000000234e8-2.dat upx behavioral2/files/0x001400000002291a-6.dat upx behavioral2/memory/1036-1032-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\it.pak.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 0c324f1b804a061897959ddecac28190N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp 0c324f1b804a061897959ddecac28190N.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5ab68070019a1130d74abdadbac983546
SHA103df66e91edc7185d89885f44ced7a2327b25276
SHA2560d1e00635c60a8305c9be9f27446195b09535d68072c22b3509398ce2cf13337
SHA5125969883d4ca0d45ac569d139aed7c91b650f73c682a24064a706fe2a9168a8773a9c8b0f5c1ad7e8d7ca2d6e351082f9c038ec97917a6d88169226fa97881e27
-
Filesize
167KB
MD501abb22fe23b35928fdb73f2c7ca0fd0
SHA1a98b240660e8b579ad8f355712db9b994cb9a136
SHA256ea07a482affd43cc0114742cf2e838915a5cef7bffab9646409579cb8057d04e
SHA512baa81a09852dbc2428921f926855c39d726f1a0ab0443516430553c9ae853bdcc00ffe44e621d7cbdb59a4e88c7257e0f24cd20e33cadcf53074ac4fef526800