Analysis
- max time kernel
120s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 11:44
Behavioral task
behavioral1
Sample
55aa33456cfa8107c23b8a6905e1f6f0N.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
55aa33456cfa8107c23b8a6905e1f6f0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 55aa33456cfa8107c23b8a6905e1f6f0N.exe
- Size 35KB
- Sample240825-nwmpdsthqq
- SHA256 948a0dd824a5946e7e4038ef5368fa0ee0b1f9130ec80e4d3737494038f8f905
- MD5 55aa33456cfa8107c23b8a6905e1f6f0
- SHA1 134ad427cd5989007cb61f176164f9da6c9bb7ba
- SHA512 1281ea12bf9fec4d6deb4475ad4444b2482909fdb99f1fb9d4a676f529f937156bded090340ab227026daf57c13c22c6c258d6d1d995d8afff0a475c2a34ba1f
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mF09Ub9ULa+az:CTW7JJZENTNyl2Sm0mSWbWLa+az
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2296-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0008000000023464-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/2296-901-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 55aa33456cfa8107c23b8a6905e1f6f0N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55aa33456cfa8107c23b8a6905e1f6f0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp
- Size 36KB
- SHA256 81ac3a87e7404433856d66ed3af594b8716e96f38fbb5e1dd17f040ee5701f45
- MD5 f7e50c664e4bb05772089914662ca033
- SHA1 9ce84a4e6536bb168282410d0db83395e479b736
- SHA512 4aaf93b6361feab453a41d845644b0da8e4f6db38d0a31247c2b17e772e9ac0e7b4ca844072f503d78603fde61f0c33e02d4ccc8890c8f350050d1d488b897bd
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mF09Ub9ULa+ar:CTW7JJZENTNyl2Sm0mSWbWLa+ar
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 135KB
- SHA256 bb57c865d0ac873017c654ad807361c7fab7e657529a4b45ee17a47e9ca3ff9c
- MD5 3a16638f41f89e95a929aeba8dd4f8bf
- SHA1 40f92f6d4e2b61ba2904af685e2ef27adf4731f4
- SHA512 01465f93bce97af8f807884dc2af3866aacda20a9dc18986be7e415449c48844539986c3493354928e82c720e17d850c297fc56ecb06a6d3380a3282328cf5ca
- SSDEEP 1536:CTW7JJZENTNyl2Sm0mSWbWLa+aq4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0bx:htE425WHIjN3tj6qnv0b2UrXkbvLa
- MD5 SHA1 SHA512 SSDEEP