Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 04:42
Behavioral task
behavioral1
Sample
f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe
-
Size
46KB
-
MD5
13a0b6fac215e35cdf826b9f2dd40eb0
-
SHA1
5dc9cd1a6e2ca4af8284a11d126ffde50335bdf9
-
SHA256
f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085
-
SHA512
b815941114c230febb0ecc86132735918f16ea2439d3b3d72559624dbc3708e61737332970ef36635b074d704be275af1c26e90e1a2ed35bc40cd1961f42378b
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJBZBZaOAOIB3jM2jMO/mg:V7Zf/FAxTWoJJB7LD2I2Iy
Score
9/10
Malware Config
Signatures
-
Renames multiple (5015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3132-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000600000002325a-2.dat upx behavioral2/files/0x0004000000022949-6.dat upx behavioral2/memory/3132-1794-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jre-1.8\release.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\CompleteTest.tiff.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\eventlog_provider.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe"C:\Users\Admin\AppData\Local\Temp\f10cf63d4c7ab924329386bdc077a6806223bfc7bcf5394c683eb146d07a9085.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD535e0598986716bfbc59559313f4d9f0a
SHA1c2b7cebeb3bb31dc2f4b114b05603fb90af86a4e
SHA25645b4de4323e2a0a6956af1a6eb16d1a3da9a7c76fca4ccde3972c55baacfb5d7
SHA5128fa6977d069039fb755fcd679f6db4a1935c3407d3af89f957ab6ee74b6bfc56a499a58a642dd12f615810085b6281c43358e8c6109c3da857b8bac29e3080d8
-
Filesize
145KB
MD581bc57287ed75066339018c6dd8a07d4
SHA1804cb75a5555e869703e205a89b836626d3933e4
SHA2567d01301bfdf82be2a7b68049a058e08b9ed599068ec7490bea6b6f6ff17611b3
SHA512a9a96ba3355e176b976bfc87c13e04f6faf610d9df4ecc92483510cacbf9a243d4d215c0815732958234bb551ae8cc3ef2c90b15afb53b41426b580bc85e494f