Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe
-
Size
52KB
-
MD5
05929b0c366ced4418fb6f7593eadcf5
-
SHA1
0deec52e7eec79c2f3c5cc538709d81356adcd40
-
SHA256
ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7
-
SHA512
080e84fa560712708fb84a0bb496b2e8778af5d79f27daedf672fc6eadf7237f1682b8fa6c8eaaadcffcd0d783f5d35b86a5bd20d88c486cd4c6965e68792796
-
SSDEEP
1536:W7ZppApB7tlJ5OvtlJ5OwF7CujdyGdyMMkPMkvLN:6pWpB7tcttFOu/
Score
9/10
Malware Config
Signatures
-
Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp ab43651585336c041aa2c85746622fcbae056422b995b7d6d1f8adda154d04e7.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD500c83795cdeee614adc3fb2d7d874e44
SHA1b185ac2cf25db526168a0147fbf25fc36c385190
SHA25616c000daf741532671966a622c76c4469801dd733bd065b84f257eafd838d3e5
SHA512cb5faa0de55699e28e387fd13492d8712d30bfb1a0d6580efef9322497b4c98cb99f591642aaf10ef8a51ffde9d2aac254168d9d923537b93501e67be36f6072
-
Filesize
151KB
MD58906f80ad56f1c7083aaa65afab85774
SHA10b1d7671c37ca78a4ed2e0bfd5ae751d78e728b1
SHA25630f8f45270d725adb7df5174d498ebf961f98e0a1d414792f99c94a008717965
SHA5123ecc4665fbe0e6f5542c8ce3000f91dca7aae529a2c50ee7889ca678afc071632ecba60d19f38190c687b02ecaa2018ee3c1c52f29429a596f2db21879c8e1d7