Analysis
- max time kernel
120s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/09/2024, 02:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe
- Size 93KB
- Sample240902-cjfjrszclf
- SHA256 6a88cd8ae127eb7deadf12f69d42b06ef5cd060cf0b67da3ab406286bec5b253
- MD5 4c07e5ac3e1f2e38318d2f44bc8bb5c0
- SHA1 91a5bea3ad73ce0a4d4aedfa2f9be229aa8fcc8f
- SHA512 287066a590a41fd105daa1c682ce4368a6c201658140755bb97ec81312ea01f2a8a4d9b0903236de72d3cae6359dd2511e1582d2f1e39d0d4559cbc1add36390
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWSY84IkI+:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSYH
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c07e5ac3e1f2e38318d2f44bc8bb5c0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp
- Size 93KB
- SHA256 ea5b09e4341daef3c17fd4490313c180a2b4f097c217f72874d1bfa5973a4c69
- MD5 13c6484de2b7c826450c719533924e08
- SHA1 f40608254988312aeb3e0b7429604f12b65dd8a9
- SHA512 65860b106ddf57890145de3120947c6b59ce2a554ea1f1a6d057e927a8addb5637ccd72d6280311255ef171ee24f85e2a3208cb56e2dd2710a5ae6aefd44d305
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWSY84IkIp:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSYM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 192KB
- SHA256 ec1287accd9e44932d3c326011cd8dd367ce8c1b209258256b11f073b7ff6316
- MD5 6d8f57430441945e6cd0cd2ac5e60495
- SHA1 fcdc52b232a3d53a1b9098bbd78cac613833e3d0
- SHA512 64d4d053814cdf8a9407f247b4dfaba571137b95e488492182fe687c41a229228222a696bc55135de2d990688cc17258caeb78ba9f25295448e805bdff0b0633
- SSDEEP 6144:RqKvb0CYJ973e+eBSsIkIfIjNDv0bNXkbvLI:vvbxYXySbIZGNXkbvLI
- MD5 SHA1 SHA512 SSDEEP