Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 06:15 UTC
Behavioral task
behavioral1
Sample
67012c1911a76df2c8571701725e1a50N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67012c1911a76df2c8571701725e1a50N.exe
Resource
win10v2004-20240730-en
General
-
Target
67012c1911a76df2c8571701725e1a50N.exe
-
Size
96KB
-
MD5
67012c1911a76df2c8571701725e1a50
-
SHA1
6cc539261b2ef3838e6046139fd81d11d5d9a026
-
SHA256
24e2b748663586f9126e95ff212b0124f327195cca6c01ff2f3a60f000178328
-
SHA512
d4f6af74daff74ff5c992c6b67dd9e57b6ad7ebd4110849f7b07297d05776f66d517bdd8cecfe81ad5c3136701ddd05785bc8735c8cf70ecf93ea72f913f3845
-
SSDEEP
3072:fnyiQSoJUBM+PocOQejPdMRAHAASnnD5D5172HyZU3YF40S5DnumSFDnDHaJP1Bc:KiQSo//PxPa
Malware Config
Signatures
-
Renames multiple (4338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3916-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023371-2.dat upx behavioral2/files/0x0014000000022937-6.dat upx behavioral2/memory/3916-1788-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ml.pak.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp 67012c1911a76df2c8571701725e1a50N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67012c1911a76df2c8571701725e1a50N.exe
Processes
Network
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request147.142.123.92.in-addr.arpaIN PTRResponse147.142.123.92.in-addr.arpaIN PTRa92-123-142-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
147.142.123.92.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD57da10b84357d7c112c17af5725c88184
SHA1279700790158eb40d290c21ba07aeb3abaaa1649
SHA25606d523eac39104bc015256d8fe8f628d90ee74a9a45cdbb8567889eae3d130ba
SHA5122beb1d05a8634242d31870b0677fa9f43908b3ed03a303a4d6767db227f6e71fd1a36dfa9268f1d68364af0358ffdfd54a9ad103f5f70bc4a1d9a4459eb0cf31
-
Filesize
196KB
MD577628a84c69f02deee44b1b308f82af9
SHA1ea35784a79dc7d8354f19c66eda8165bf9b3cf79
SHA25617340af617096aaa9df1403e7d5e0484234ba357bf1af0ebf4e42fdb2e031988
SHA5129cae4311744a63a30dd469c8a30315fb07a4bb39e803268ef6ba266da4c0c3109383bbca3a78678cc84719964ca775400ca9db4ee2e9d946ec0530c512cf858b