Analysis
-
max time kernel
32s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:04
Static task
static1
Behavioral task
behavioral1
Sample
e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe
Resource
win10v2004-20240226-en
General
-
Target
e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe
-
Size
78KB
-
MD5
001451eab99ecbfb615c3cc965cb332b
-
SHA1
b794456ea3e44564f2e87c4c518435ab3332f768
-
SHA256
e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5
-
SHA512
5f9b5ea1516cb6718bfaf411ec5818c1461dd37a14263259a2826fe1d809f11fdef4f5510f8cc2b3bf13f67d0b40fefde60f50f09541d17ec78253e69ec3ca97
-
SSDEEP
768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhw1SqJFqJG:W7ZDpApYbWjIoPyPoLzV7c6Shw15+G
Malware Config
Signatures
-
Renames multiple (217) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\readme.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\BackupSend.pdf.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe"C:\Users\Admin\AppData\Local\Temp\e8551374b10d13d01798da73fee37c17b49d78bf3d27ce54cb1c6ba44b2815b5.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmpFilesize
79KB
MD5f7d46e850e7418d696d156757930c19f
SHA10b85588b3a80518aaf66d5920b06054545d830a0
SHA25662e9f51fb78722f9bf49db28f21c6487542af6a028c38e55d7a7588d62021ac7
SHA512e1d6a52a01cba96fc205d7c41ee1430e101a4d32cbae88d0cc8c324629bee856c5274c82b57339bdd551c703ba53490b49fb3d3db136fc70decb9726e38f5be7
-
C:\libsmartscreen.dll.tmpFilesize
78KB
MD592ae60fbb086d72f5f79073702d61998
SHA12fec61d561828d233e264292ce9d343ca85172d4
SHA25618b3c39f32a06a625e83dff94d48e27bab31a71672fc5b35c7d51f53381476e4
SHA5126177a6bc2c78caa35e26ebed6cb68f70530bae225d300433125cfec4f871cce204f843459dc61d9e8fa64ae9c638a3511ca7c8faf5e09fb1a57000b40af2f36e