Analysis
-
max time kernel
119s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 19:48
Behavioral task
behavioral1
Sample
1fd9fc1928a6ba8341866cf6d38d6050N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1fd9fc1928a6ba8341866cf6d38d6050N.exe
Resource
win10v2004-20240802-en
General
-
Target
1fd9fc1928a6ba8341866cf6d38d6050N.exe
-
Size
55KB
-
MD5
1fd9fc1928a6ba8341866cf6d38d6050
-
SHA1
03b34242512521d7f1485bdff0775d5fa6b3246c
-
SHA256
5fffdbd35c944b6f41cb513c2184c7420520c079916d438097cfa160e20ec005
-
SHA512
4313976e7f619ffdfd068fac3513010e1beaa71b8729dce5d91a175f127d704f46a386fcdf1a33967de8c869b910ceb5b69f6db34b1aa12b9f99b30b9ba300c6
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZTcM4MT:KQSo7Zf
Malware Config
Signatures
-
Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/460-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000234b1-2.dat upx behavioral2/files/0x0014000000022912-6.dat upx behavioral2/memory/460-1196-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp 1fd9fc1928a6ba8341866cf6d38d6050N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fd9fc1928a6ba8341866cf6d38d6050N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5962210735cbeb28ecabe87ce97f53ed3
SHA1e4f1aceed315a975796db167afd1e01b61e31127
SHA256630387309a2cf6c02752c1a40e7aef8cd15640089dad216695ceff325472169d
SHA512d9ac411c46e95b64274dc20057dbe7a7b6754ca6242dddc75af76b094fc96300d28d59474f9cfb0167b6ac5ded57cf8e970f17d978167719e905428ae652b118
-
Filesize
154KB
MD59b27e27880a12060da4e1dfa83e449f6
SHA1fbef9b27ef1c300a0be8d2ae7914f41225fde86e
SHA2561f1bb9c6f37cbab9f11ea6bc35b73a57d56a87b49717ae89d797261ffea44bfe
SHA5124b17e11a0d3522c8f1d281614d075c4432571a1be778c2a493804cf9eaad9235b02f516e52c4f206cb58ff928cda0fd132c106e424d63191a4831843c54ab8a3