Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
6da995f32bf6bc11856d971c5b252030N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6da995f32bf6bc11856d971c5b252030N.exe
Resource
win10v2004-20240802-en
General
-
Target
6da995f32bf6bc11856d971c5b252030N.exe
-
Size
80KB
-
MD5
6da995f32bf6bc11856d971c5b252030
-
SHA1
5955f7f180dc630dec3dd1003697ae48d33bdda2
-
SHA256
197a037c11e10e6765c6283dd9f63ef112f98fd10b9a12c942571ad2257a96d0
-
SHA512
90c5ab5ae6b3acd7b2754228965688667802dd8b784ed011175a37838ca3b6d57838c3ac380c53be6e3cc1023aeaabff02f2971d20397208580188fb07f45bce
-
SSDEEP
1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWu2:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWu2
Malware Config
Signatures
-
Renames multiple (4611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp 6da995f32bf6bc11856d971c5b252030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 6da995f32bf6bc11856d971c5b252030N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6da995f32bf6bc11856d971c5b252030N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5759a3103752155ebcf194df6f782d0bb
SHA1994307f0b43c12c01d131321604aded6a71e20b3
SHA2564bbf0bc6b99c5a6b16ce4263ecfc52963d27cb6ffbeec31f989156fb495575dc
SHA5128a175015ac6e5db900732228cbc96fbc4661bab356799324dd68bc2be04daa07491d37292020043ab7c879005245231ebf0cc6aa299c4dded9ac95150266cd61
-
Filesize
179KB
MD56af61536f6132f14996f56b3eb2b7266
SHA17b6112df76cad69a7d23fc55a571954535a6102b
SHA2568f562e236cfc1a202ac3f8f4b32bf079ae163e8fe5c6108e5907e5937106943b
SHA512265302110795830d1330ec155511b8f1f94647ccaf64701b35913eaab7d6922eef4517a2a6f3a413857fbd282876579ce448e83eec544294bad687ba428ae748