Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
46e1ec899f5a0282b1a89306dda15210N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46e1ec899f5a0282b1a89306dda15210N.exe
Resource
win10v2004-20240709-en
General
-
Target
46e1ec899f5a0282b1a89306dda15210N.exe
-
Size
46KB
-
MD5
46e1ec899f5a0282b1a89306dda15210
-
SHA1
2c6ed268b5eb7c88c5f4d944c195cf755e10e9c1
-
SHA256
988a2c88ad1c5bd07dab66562857772d874b9feca9631efe46c0ba7b1b12876b
-
SHA512
02abb62c563b7de0753c09d34872e1019eac7b3b8313c8b09066586ea0422f06ae90fea7979855d055bfdf801c91876281f006f0ea00c4cf8b2ff32428d1d432
-
SSDEEP
768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6nz:/7ZQpApmi6nz
Malware Config
Signatures
-
Renames multiple (4159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ru.pak.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\7-Zip\History.txt.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 46e1ec899f5a0282b1a89306dda15210N.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp 46e1ec899f5a0282b1a89306dda15210N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46e1ec899f5a0282b1a89306dda15210N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD51bb28c7b72990d3031242ddaa10420e8
SHA1de4efabbf2c01b1e3b177a52b380d8b94820ec11
SHA256d3fbfefe11a08d0d193210be377a90503bc92433c4e3303e359231c4997cb8f2
SHA512f237c69580c7d459030ad30509f159a644d6ad9ab4a257b33dc9bedccca20b17e3a7bfa5b520ef708c933be85313cbb8f16df6884faa8b80430e5e2947250a9f
-
Filesize
145KB
MD5f064d2727014174364af558be4594071
SHA1c80c3fc2c9e7bd75cf9018df9d8bd5d61fcb4503
SHA25658acece5e8bfa7f425e97114799d8273565449806b77bdb1be4a0c786825b3ca
SHA512d4af2c962bff3c605d91251339b6a67c5502a9dc5a8a388d43579b9a47b288f46bb2c3e25bfeb5a713397506192a0142def7f3b855be58e85d7f17dae76c45f5