Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 02:37
Behavioral task
behavioral1
Sample
98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
Resource
win10v2004-20240730-en
General
-
Target
98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
-
Size
28KB
-
MD5
8ceef7814a0552f57907d6fca6733940
-
SHA1
3a01c224c371185f3d4e3f10cc403e7829bfdfb8
-
SHA256
98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2
-
SHA512
f7190a734a83cc9e3dd8af1efac39a13b7f43312594baee27928bac0fc932d134d5f5e8a09209a44868bca01bf4c86fd0ba7a3d33c0f3879d2f27e9672a77090
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PD:CTW7JJZENTBHfiPD
Malware Config
Signatures
-
Renames multiple (5024) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1968-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x001d00000001e577-2.dat upx behavioral2/files/0x0014000000022950-6.dat upx behavioral2/memory/1968-1092-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Crashpad\metadata.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ta.pak.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\LICENSE.txt.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe"C:\Users\Admin\AppData\Local\Temp\98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5342314015fca9e6a3901644711d3fab0
SHA1d7070279a14327134daf2bd8ae1b708b286dbc97
SHA25648c6f2af5cea8d7068ec5dcd22fb4b7b09165cac42ff25defcf19c543a4f2f1f
SHA512827ddfc3f1e47a275f13c0f3b5c70098912cbaf97f7cb4edd81517ac275dbd4a748b5d59dd8ccef202ee2ad29f927ae97642c24e09b9ca0aedd5e1bfa3d2fdb2
-
Filesize
127KB
MD5cc5fdea99cfafabc8b995ca8eaa99c44
SHA176612a402e9193dbcaa4f5ab8931e9a6349fa3f5
SHA256c7a6e3f2af1b00279f1fc700f59fda5c218a41daa5ff66eb477bc47d4ccd5d5e
SHA5126bc77bf08de4a0c248be395cc58aebf55571c67a37f0137c1ad8b172c61fa707f898ffb289bab9080728467dc6480d657b8571daa5c2cc0e6e8321dabbd32a94