Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe
-
Size
54KB
-
MD5
cb1a3f62e1ea3e87b3165a18a25eaa80
-
SHA1
577e5dda3999746857c43a07616bcb52e5559310
-
SHA256
be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a
-
SHA512
8f2378e36b1ca6e22dac5468ca973b725204f1f17a5fe7846b4daef163c54da0d1b36f36495c611088389ea08cc78d3288f8902ac7e4c9813a98e55c2b91b7c0
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0I0gQemyq8gCgQemyq8gQntn2:/7BlpQpARFbhNIiJwsJwwnZGynyrntn2
Score
9/10
Malware Config
Signatures
-
Renames multiple (5147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe"C:\Users\Admin\AppData\Local\Temp\be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5092da7d0490a2242b53b3cca5706e6b0
SHA1a5a6665a4262ba07334669f50cece3a3c9d268f6
SHA2564fb9eabccdac7a6f7834fa58186d4b1debfbc7b3be891c9dc522fcac7dc27d37
SHA51229371782b036acd4c9af9b00b723a58d6b67d59d601383dc4c33c78028b4e41a006475f9e9cc2dfac7c4a985a1fcd269287a4db102984d05f8753e5d4699624c
-
Filesize
153KB
MD59b96ac792f144b06946c2753302e7edc
SHA1530af05d22e6a08de59656879f045a17eea45bde
SHA256ca0b7f5a998f681719f2c5ef1b852f7747a4de1c1b8c33da0d09d242aa9cf473
SHA512ca05b2a05e68e079be4ac1c73bdfc52a023222f3c7643030457d09d80de34c0cd2208ab3e2c93858146915645cfecb0d649a9cc3f5884668b1a39eb3765d74b8