Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:35
Behavioral task
behavioral1
Sample
5ff6128a99c8cd09bc3d5767d0157630N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ff6128a99c8cd09bc3d5767d0157630N.exe
Resource
win10v2004-20240802-en
General
-
Target
5ff6128a99c8cd09bc3d5767d0157630N.exe
-
Size
58KB
-
MD5
5ff6128a99c8cd09bc3d5767d0157630
-
SHA1
6aae745968989c2e9d45d923119f4513c3c0b1cd
-
SHA256
ebd2dce823b81d75cc767c3c1fbcccfccd78c595664f51b84f8cc60c55378cb8
-
SHA512
16c8112f1bbb49f8548c0a06c6d63f345293fa1f9a8b9e6662179efd35afae784e222bc7b6b3e0e57bce6c7abb480506bc5a656d845449d05fbcfe08a60acc9f
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tirZSZ2:V7Zf/FAxTWoJJ7TTQoQh
Malware Config
Signatures
-
Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1200-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000233b9-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/1200-856-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Internet Explorer\hmmapi.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 5ff6128a99c8cd09bc3d5767d0157630N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ff6128a99c8cd09bc3d5767d0157630N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD56ae33db446acb7a0e82e23bc9c1246dd
SHA1cc48886ace09dc07e3f1c6fbc1fe7c4244955ca5
SHA256e879cb4ddccc3f381631398307ee0947a8c44c2da7d20c10b799be31800ad4af
SHA512f472b558bb43698d5fa8d26f642da5ac4277daf0717694404aca46629b314d9a516f734651d16b96cb21f49b803936ba1e7543e4fbd2abd0751f342db2dbf9a9
-
Filesize
157KB
MD53afa3f9aa9fe32403e47db5e7c998e77
SHA126bb125fc210c18cb932ad08cc6f3392919abc5f
SHA256259def5bb573c64168f153951566eb0058cbcf306350b70e7e175192ba0aeda8
SHA5128ac06c5df9a70220591b57bc3fc08ad140e55a781a0562d2bf11ad678053d458a21de94f12555c56ad11ab61b8a16bd2b2e9440d6778960c3fd5f14e96acb1c2