Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2024 04:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe
-
Size
115KB
-
MD5
0ed4f210fc9b9623084985748de7c641
-
SHA1
2f750dd6bbccbb502217905e3a6ce2d894a41f85
-
SHA256
f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398
-
SHA512
99a49981d912fd4b122008f58ba4096cb687bc502ddef26f3b99b2c7c8fc46977fa96a41b0e88a64fb5117f00a06e125a339c3d789bd57b7c45bd2c996597dfa
-
SSDEEP
3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fb:RqKvb0CYJ973e+eKZOf7fb
Score
9/10
Malware Config
Signatures
-
Renames multiple (5028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe"C:\Users\Admin\AppData\Local\Temp\f5e88136e2a24b31dfd9886ffb23016e0c9d8f91b42d1d6850d877d7e6ef9398.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5e55cf7c0e6cf4ed11c3b730c30501b6d
SHA125e6df7232078572d0299a59331274348b24fdb4
SHA25659295dd41e9175bf0fed96007ca5c02b509b2575778ae62dc52f9d5bb51d2e14
SHA5127fe4a7b28cde8ae9372c4be43d74ed3d204bc42a7f7c7d2194e858b72ce6a9d458398dc78db5bddd09350ef0e0b741aa6130997896efa5db962f2d491d3f5d88
-
Filesize
214KB
MD5760925510701b7edaf14b14e364be7e0
SHA11d7ed8adf4b15ffb964bdbb42c5d9eecb079c20d
SHA256f34e8abe71295fdc9cb01d272fef129298d9c948d541e4091c72e87107886b36
SHA512cdd07d875d74cbb00c05b52d4efd35d0448d569c2dfccd566a54b543a42143a93993d14cac4df9e7ea5ddaa57732ac1c28fa55d6856bae0cb44608185bd8184e