Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2024 22:19
Behavioral task
behavioral1
Sample
54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe
-
Size
56KB
-
MD5
bde497823e875665a814ec64a80ec163
-
SHA1
511bb90942bed8428cd2d1825698eb6c8e1e365c
-
SHA256
54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11
-
SHA512
4d27807586ab7a0a93aed65b348bed4b7b774f70ca6e670bff71a33a6c549a49666cfb926dabd09263180b68fcf6ab6ec0d3d1bf1d46d832e926b57d7ea13a60
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJb:V7Zf/FAxTWoJJZENTNyoKIKMpS2
Score
9/10
Malware Config
Signatures
-
Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/212-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023383-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/212-862-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\DisconnectDisable.gif.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Crashpad\metadata.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe"C:\Users\Admin\AppData\Local\Temp\54d2a8f69987e3e11641523f2946b79bd3403dda7cd5b4fc2210d03dd1813f11.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5810bfe272cc391011c0d22a44541d9d0
SHA1f22e797c105fd67c81adf8d46caea374cfc2f4a6
SHA2564d703f00027e60ff3958eae74b93b28e62dfa922aea80cae3ddcf4bcb0b7bc4d
SHA5124644defbff3ca76577b943e7d41bd8f37e0cbd4eb55ff8a9a2309885a0fa91a2f13005d2e63a223c9ff2b90c062610fcb217ce3c26c4478c13379acf8a545026
-
Filesize
155KB
MD5da666180f8eab20ddd0d3f8b88a83495
SHA1bd2c9dea9ed6324ac65729806fe3874b5d72ef78
SHA256f54b12cbe7c45b755e22e58f5160f9bbc0743d6d7ffa2526e84c32abd424f483
SHA512f30316a557bb38f13ea94dd65c50ad4784d2066807ba90ee84cd24ef03c17dbb41a0e043c3c303ffb1047b818d67d76d29e98882bc5586ea981b328c4005cd47