Analysis
- max time kernel
150s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
16/08/2024, 23:48
Behavioral task
behavioral1
Sample
6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe
- Size 57KB
- Sample240816-3tg4fsvcrd
- SHA256 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab
- MD5 68efb3b0d7eb81140e4b3f3594718007
- SHA1 21dddac42634b5997ec9d9253efffef21aab11a7
- SHA512 6394d2288adf3a641acd0c3b32660e17047e6e5ec9ac4b62c39d18bc4c527eebf2bca18d4127e380eb131781c215dca716d1ef5d01d41177ee6056148f3c057e
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyQYCpwu1a:V7Zf/FAxTWoJJZENTNyQYCpwu8
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1500-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002346d-2.dat upx behavioral2/files/0x0014000000022912-6.dat upx behavioral2/memory/1500-866-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJH.TTC.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe"C:\Users\Admin\AppData\Local\Temp\6443c1d8c2a6f2694f60892fabfd1a2e6aabd1ff9b4488c0b4630adf08e354ab.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp
- Size 58KB
- SHA256 194c63eed4b6dab8fdc954249314464d8ad2dac5822a93eeb11d5a4a21ca673a
- MD5 0c9408116e0e1a42582e4c238625a763
- SHA1 90f29efe61cf503845329307d66cd03fb1655cf9
- SHA512 fdb0851c9480dcec499b0e1279232d132e47a042add1f4c5ebef35e7519490b0bb7098ab7c22857c7a9b19775c1955acce82e590cf7243735a7bdc9ec54d02fa
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyQYCpwu1n:V7Zf/FAxTWoJJZENTNyQYCpwuZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 156KB
- SHA256 75bf7ad4da7f86efec099c8beddadd84187e88dde43e2f0223944c0be32462d0
- MD5 e03d993470d5e198d39a534e0be0ce74
- SHA1 1b60eb00cf4140994a9d4645faafa1ce32d94d86
- SHA512 90fb621ed6f35ec978dcfcc462ff4afb2c06c6afeb3056935cf3331546f19b74de8af1cdffc7f9274edfe8f080d19287c478c9e6162ba26cdc9cdd045701277f
- SSDEEP 1536:V7Zf/FAxTWoJJZENTNyQYCpwug4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2b:fny1tEIoWHIjN3tj6qnv0b2UrXkbvLR
- MD5 SHA1 SHA512 SSDEEP