Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe
Resource
win10v2004-20240709-en
General
-
Target
edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe
-
Size
45KB
-
MD5
cbd4d5cb6a9401487aa0f4fa8f32752b
-
SHA1
4f043b3d94d2d50b59e1e30858a78952177855ad
-
SHA256
edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0
-
SHA512
49accd7a577e9a443049195969e6d94d60426657795624481b13aa59595a9126cad55e17406f14274127b509eb3989973d8406d8553c87db390bce0adb83e797
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJwNqikTqikYkZ:W7ZppApyqikTqikYkZ
Malware Config
Signatures
-
Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\DocumentRepository.ico.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\icudtl.dat.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe"C:\Users\Admin\AppData\Local\Temp\edc2856970857c5cc1c13156da3b8fa83e4bafa05e914c8048d17e916b287ce0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD56b1e9c56e6dc42428045dbfa3230039c
SHA10cd7e5bfb673070c4b5e28b0ab376845c053f4c9
SHA256bf59b764b2756923df2429ddbe0190081acad97fbcdf5e4672d4d097ed75f3fe
SHA512e31be8047fee4b68f547c52fa1f012485259cb89f47f82785323896aff67e97e985e85858c3454faa26289100f099d44217b4f3809184868b702e2a97c0ef015
-
Filesize
144KB
MD5f06b4af7e8575b91ad4bf470e5eeacc2
SHA1dc9a656f2e883756f637f042adfca993f68bf6ea
SHA256fda7437064dfb3af1662470e9efbb18c6ec482d8c5e5b4420c84fe523c51348c
SHA51231857a186b2a8aa1638945f658140ed474bef387eb3feb7a0145fb8dec7e9cba359f9ff9cd13b92d560dcf102e3d60aa76a50f686e9719b0b19e9e87c2953707