Analysis
- max time kernel
120s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
17/08/2024, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce89c7c079d646011e3f1d71849d9510N.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
ce89c7c079d646011e3f1d71849d9510N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target ce89c7c079d646011e3f1d71849d9510N.exe
- Size 86KB
- Sample240817-3npakstema
- SHA256 d60fa0f94f0c25b60ceeb5d416f9759469c45c0b2a1a9d6b6cc9d7faf8691686
- MD5 ce89c7c079d646011e3f1d71849d9510
- SHA1 eb6daf221cf37d9190bce0748fd6b1d49703a731
- SHA512 d7cf65891eaf1786b6401525a6b2b7e613920f752a89bc9194ce8d1a28119125c806854ccaec617b3fdf8279e893e8d39c0bf32bbc6994dcee878e2972d03c18
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWXB4:6e7WpMaxeb0CYJ97lEYNR73e+eBSWXB4
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4640) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp ce89c7c079d646011e3f1d71849d9510N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp ce89c7c079d646011e3f1d71849d9510N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce89c7c079d646011e3f1d71849d9510N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp
- Size 86KB
- SHA256 434064ea1346b408ccffd18df6d64ac6a8934f8f566bb25d232fa0b450a7cc28
- MD5 95db338666d6a2ecf473cc5f5947421d
- SHA1 f58648ff2e6838f8725f14d65a3b0e0e3707235d
- SHA512 e92b9654dbcec1b2701762b2961bb3658e2606d5fd5dd70b567f6045d248ea8da7af56c0ac2b85116c479afe4651afe4e4ac324eeb82d72bf5133571bcb02428
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWXBMA:6e7WpMaxeb0CYJ97lEYNR73e+eBSWXBR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 185KB
- SHA256 580172628d9d4e630efd584c9eacaef93fce4b76287a540d50bbc8b5679b03f3
- MD5 d531838d129cf07db906fb6fb1c7ef57
- SHA1 484637c0a83be410d066b3220d10822688484abb
- SHA512 5a0b8b31fbaec121bb859dba2272b5feb3c915761b71e6ffee90867d5a7e6e76aea3aa5909c5ddb66179f22607718f718a5c48dd58ffe34e81094e64fc185540
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSWXBHWHIjN3tj6qnv0b2UrXkbvL9:RqKvb0CYJ973e+eBSsBcIjNDv0bNXkb5
- MD5 SHA1 SHA512 SSDEEP