Analysis
- max time kernel
149s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
12/08/2024, 00:27
Behavioral task
behavioral1
Sample
9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe
- Size 80KB
- Sample240812-arwvls1ckf
- SHA256 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b
- MD5 513ee741732ca6d51f600e3daa8a6da8
- SHA1 156b7fd03a5495f321db324264c741e4033bb299
- SHA512 b6045b8d9c539b22ddf2308145297e2ebd94db744a47ab9081c967b4b672ee44c381d9bd1dd7a2e4112bdd76bcaf291c7be37a57250ee1495284fb6d81ee2fdf
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZR9TZi9TZv:fnyiQSo7ZTZcZv
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/372-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002348b-2.dat upx behavioral2/files/0x0004000000022933-6.dat upx behavioral2/memory/372-1922-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe"C:\Users\Admin\AppData\Local\Temp\9e233e0aaaff69f8b66fadc8b03ec4261367590fd255f7ab23d6654d57a80a8b.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp
- Size 80KB
- SHA256 a18c5df53b15571aba500c0095bb3dcc3dc71971ce1557a94c2f7e626fbf4456
- MD5 7a480a396d4a7f31ec65ded998c76041
- SHA1 499e75a9a839ba4cc265c0a1da3c2d0537d62aa8
- SHA512 22623a1e994a9b898b6e392f7d399f118861da3f37cbdce7d697394430dcd8cc3e78dd65da873d9faf1c1d05fdbfadd2b337934164995595f2bd322c5be33d46
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZR9TZi9TZKl:fnyiQSo7ZTZcZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 179KB
- SHA256 0e684db38d0993f6d5c3b328a4ed6b389e4ddd9c4a4a9c1a6c3a619d0e1a7d20
- MD5 6ef42aa09d07a4d2c56fd65fd453b4b9
- SHA1 238c256068ee25419f42dcec72f0b507216cd0f6
- SHA512 8195e90761e726182b5081eab581d7bc95b45b78608ff4f2b38f38748c187d54168b8dc5e3b3777cf4df5fe347797c1caa8a12f8142f67a1cc76be668f87797d
- SSDEEP 3072:fnyiQSo7ZTZcZ4qWHIjN3tj6qnv0b2UrXkbvLK:KiQSorIjNDv0bNXkbvLK
- MD5 SHA1 SHA512 SSDEEP