Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 03:33
Behavioral task
behavioral1
Sample
d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe
Resource
win10v2004-20240802-en
General
-
Target
d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe
-
Size
36KB
-
MD5
9073a9e4d27964d4bfec7dcde7fb8de8
-
SHA1
a15f1142948c4aff53437720a92992c0a89bceb6
-
SHA256
d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672
-
SHA512
5618e1833f77932bece5fc209a9e1cff83a12d91a5ec8f8712df399aed54017c05818c75a1d0de1086e539b862941415a998c49d43901350f72d29b2f46c60f2
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tizKPKg:CTW7JJ7TTQoQza9
Malware Config
Signatures
-
Renames multiple (5273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1848-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023424-2.dat upx behavioral2/files/0x00040000000228de-6.dat upx behavioral2/memory/1848-1220-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointTeamSite.ico.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Crashpad\settings.dat.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe"C:\Users\Admin\AppData\Local\Temp\d04a252110a192cbb1c165ff94d047bf7d08a366b01f8a247dac1f5b353b1672.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5a7ac5542ab3e0b8edb898863bd63e7c3
SHA1009b5552bf9bf911c0a654b464f5ee2a714e4364
SHA25631f4cce68408505193878d22fd2349e7e3f4572e4a7524bd01b6f036455e0bfc
SHA512aeaef92c1e31e98275b3a429d2bb3052b179731813a65bf5b2c7fa4ad1a77f83058935a3be73249cf46b022cb4e051e806a9a829a60f5f5cf55f7cb3458432cb
-
Filesize
135KB
MD5fade681e3ab1c58ced438363650ed22b
SHA1bea0f207855e8b6f3417816cf2cf594848b9ad76
SHA25681e06ffbf263f8abaecc279993db069f79976c01082980785e7fd0442ce8d3b2
SHA5122aa36c8f43ecd12b4e85ae6fcb9a47077aeea27e32a6a6a6480883cb76fc08494370b2028918ee23d9ac92f80c413ad86be981bf8d9c38d5e78cf9670d21caf1