Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-08-2024 20:31
Static task
static1
Behavioral task
behavioral1
Sample
2bf55559dcb9e30887695ef1a04abb20N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2bf55559dcb9e30887695ef1a04abb20N.exe
Resource
win10v2004-20240802-en
General
-
Target
2bf55559dcb9e30887695ef1a04abb20N.exe
-
Size
41KB
-
MD5
2bf55559dcb9e30887695ef1a04abb20
-
SHA1
8077a1d239de3830edb4f30be450e5dbbf4e6aa8
-
SHA256
749c8e561987b7d5192af9f54f2f01c8bb4962b490605514a35e01ea2903b259
-
SHA512
65405520e3d414273ac1547627e15a2fea51ed4ac09c4bd4e11cf0139d2d1c88fb3da49790a9155bd97412b8459f8622631eeeb48ee5c25ba1848e9c791fcd45
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/Fzzwzl83/Cqy:/7BlpQpARFbhNII/C
Malware Config
Signatures
-
Renames multiple (4629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp 2bf55559dcb9e30887695ef1a04abb20N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2bf55559dcb9e30887695ef1a04abb20N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5b68140541da2b85b29d6fab67ddb8ad8
SHA1c8beaf1b1325a11dda039837ad575519860aef76
SHA2567c17a7088a1cf68359cab2102b74d23139a605086c4e6f09d2fa0a2d3e00a20e
SHA5129f671524b20b3db65ca250091530f43c62dc94ef534b75255167f145377f7e547da572c8a91b187a6acaf9af32b7b311f7fa5ab9cc3e3c4092468c73fc20fdbc
-
Filesize
140KB
MD5cf0b8703eb97b848481e95b815f21bb5
SHA18861b26eb4a09e4f2833fb57405477a693262248
SHA2565527ee646c74c4ab59106677aec834c8aeffbc8f515561f4cb00a2c8cf2506cf
SHA512c3e1ee3859ca37817c6bfb89071ab4c00f276bbc3473d3aba5cbc1a2d1dba8e485ff6d19461c603858610178f441a52f0e9e6aebed8f4a624824789be0144f88