Analysis
- max time kernel
119s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f80f7f04bb8b3613fc6404bd5e13e8e0N.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
f80f7f04bb8b3613fc6404bd5e13e8e0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target f80f7f04bb8b3613fc6404bd5e13e8e0N.exe
- Size 46KB
- Sample240825-jetddssgkd
- SHA256 1397a0d3c4297d4eb5d86ee1343e17e3ee3447afaed8787770fcce89b177dc63
- MD5 f80f7f04bb8b3613fc6404bd5e13e8e0
- SHA1 d39e6e2311dbee422d7707c364b472c123ae0db8
- SHA512 c981573aa7f4a4994c0c7112988397282a5f02759acf4b5fc795f718efe91afeb15a838be2cf30235bf306657a3c4c8e43aecca3bf8fa44f0b496ae9ed02e87c
- SSDEEP 768:W7BlpppARFbhjbhg42LcfpR42LcfpAfxRfxuKVKgKVKOFx3FxL:W7ZppApBULcfpHLcfpAfxRfxuw1wx
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\7-Zip\descript.ion.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\7-Zip\History.txt.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp f80f7f04bb8b3613fc6404bd5e13e8e0N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f80f7f04bb8b3613fc6404bd5e13e8e0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp
- Size 46KB
- SHA256 d3966c78af87d2028971decd2fa2d624aba0df5039f39aec61c1a3363660efa0
- MD5 a9f80e3a7bc60d310ab78bf23ca1f344
- SHA1 efcebf44193bfc325aa579526e8ab2a2ebfd8302
- SHA512 78d5dd56b45905e07e69e8b1427efd151763b63793145e029fc25587a8ceab9fb28840d30fe078be33a58f408db7afaf424364bd87dfe8ea8f2e8cbb5ce64cac
- SSDEEP 768:W7BlpppARFbhjbhg42LcfpR42LcfpAfxRfxuKVKgKVKOFx3Fxq:W7ZppApBULcfpHLcfpAfxRfxuw1wE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 145KB
- SHA256 9e3290c71d9577dd18d097b9a177b1dcecc2660a92e9bc2525a56b0aad9ea121
- MD5 38d76b9336258020779379e9f2abf2f6
- SHA1 cb2af6413f19e3603d4ff784d5b768c25d853f1b
- SHA512 fd3c14c3ed2c3fc9cc005dab6f0c092a1c5b27380ea407861cc3f1b39fc3898ab9c69f42366372b1122fbff785a0a04587924ffc0ac317291787c5fc9a8f0dca
- SSDEEP 3072:6pWpBwchcKf7fBWHIjN3tj6qnv0b2UrXkbvLZ:Prf7f2IjNDv0bNXkbvLZ
- MD5 SHA1 SHA512 SSDEEP