Analysis
-
max time kernel
119s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
a2f4c2187a4526ba2fd1d409d0785550N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a2f4c2187a4526ba2fd1d409d0785550N.exe
Resource
win10v2004-20240802-en
General
-
Target
a2f4c2187a4526ba2fd1d409d0785550N.exe
-
Size
45KB
-
MD5
a2f4c2187a4526ba2fd1d409d0785550
-
SHA1
ba37501f19097a9524716dff63db3b613b30b940
-
SHA256
6021329bc6a92d68dceafc1e015751b71b6ccda6af0f7b27025504a61d034a5c
-
SHA512
31dc5e4ece23199f4a2c02d9296d7e95443388fd77edeeb700e9cb1221809cdf9a351c5c8ecaea5513aa06d49d098218fcf9e1a4b02325be32d221f5a153e18b
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSgxoVz8zJUDrYYaCusjLBEKxVTLg:W7ZhA7pApM21LOA1LOl6vSgxoVz8FUDc
Malware Config
Signatures
-
Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp a2f4c2187a4526ba2fd1d409d0785550N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2f4c2187a4526ba2fd1d409d0785550N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD550a8b44f4ddd92b6bde745cbfc8dc675
SHA1370878e9e360b81264a3d8855e01316a2b402114
SHA2568d4fdd585893a2ba82cf6011169092e67b9a3ee63ecbe73ae9e52c7e0553b1e9
SHA512658b9a6735c8a6224619aee20079a5062c5fd035ae4d637e4967b6447e556f4776cb1d077c75392a0e9d5acce5c56037cc0f0daacba228c80c9545e190c72d96
-
Filesize
144KB
MD573fad7e81e920a5bb4afe2c0a8787822
SHA107971c9ca77f368737910e3ec0d6796d5032b252
SHA2565a967bff55c785b29dce9b171de1de2f697679ff983177b4bae7f3626e272b9b
SHA512f49aa4caa1076be984efb9f18f1af0fec24c813fd284e603805ae1c42972d8acfd35a518bec9b490cf92dd530fe1ee698adb10c8a9eedbb5646243c9397f9f83