Analysis
- max time kernel
120s - max time network
80s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2024, 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be6ecdde00d944a137db1f189a8d6120N.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
be6ecdde00d944a137db1f189a8d6120N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target be6ecdde00d944a137db1f189a8d6120N.exe
- Size 66KB
- Sample240802-vy84qssglp
- SHA256 899dcc87b64c59bcb899c9ca8bd167c2a28c50917669163b87c0538af6ff5ea9
- MD5 be6ecdde00d944a137db1f189a8d6120
- SHA1 d81ec1790f5e77c64963bbd0b0e08ccc33a47430
- SHA512 44e991b93697e5c6c92031ee34e23a3d878264f0915c0cb0e4b913d6bf4cba7e358b8984b466bfd49cd11b63d5b2a1fd70f067a000de04a6d772d75eb69d97a1
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEZ:/7ZQpApze+eJfFpsJOfFpsJ5Df
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp be6ecdde00d944a137db1f189a8d6120N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp be6ecdde00d944a137db1f189a8d6120N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be6ecdde00d944a137db1f189a8d6120N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp
- Size 66KB
- SHA256 e647af47aab23403378cae95abf4de9139691c3e30b3ed5aabdaaaabc624423d
- MD5 c84f98e91d11bdaa5d3296af22b98bc8
- SHA1 c978746abcdccff176ff05123535e16f2bf5f125
- SHA512 b44d6775eb3ed2aa52864a752fce238b1538a42b112dbac6be87423d96f0c97cd2afb075577670d009cf81efd981e7ec37ea06828a71e9cfed583e87962372c1
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzE0:/7ZQpApze+eJfFpsJOfFpsJ5Di
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 165KB
- SHA256 5e8976996ff98237ab88833706fa8ee704d89ce538ee6b156d5fce31e96f7fc6
- MD5 8d38704920e39c08c2d4eaac47f54179
- SHA1 f75ffab25c6283cab1292c3a1d04c61c48398e09
- SHA512 2090cc1e4da761e596fb47c609fe6a06dd61ac76e28cab393d3869881f6159843650028d04cc546344b300b5a37b637914b4c94283d8d7e88e5cb1440eaf9309
- SSDEEP 3072:9QWpze+eJfFpsJOfFpsJ5DmWHIjN3tj6qnv0b2UrXkbvLT:Lpe+ewDhIjNDv0bNXkbvLT
- MD5 SHA1 SHA512 SSDEEP