Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 10:25
Behavioral task
behavioral1
Sample
7f4b7fdad65303fa98d12c6b7bf2cc20N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7f4b7fdad65303fa98d12c6b7bf2cc20N.exe
Resource
win10v2004-20240802-en
General
-
Target
7f4b7fdad65303fa98d12c6b7bf2cc20N.exe
-
Size
40KB
-
MD5
7f4b7fdad65303fa98d12c6b7bf2cc20
-
SHA1
db7d052a14a2d4f99212b4f14e6c2044f90b5ec4
-
SHA256
295bf921075cf4d366176bd79636935567cdf47e6e77f56831d39a31792a4874
-
SHA512
60c398e45da5d45cf1b98c8a63266f2c80130e2e123962313c4065270e9e82e1df25d0dd783305befef462d2175d24dda5db0efa97360d2d7c5097bca054eb8d
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBaMYioGXOaiJfoGXOaiJoWAnWAj:CTW7JJZENTBTYM2ltj
Malware Config
Signatures
-
Renames multiple (4633) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4888-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233d1-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/4888-871-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ja.pak.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7f4b7fdad65303fa98d12c6b7bf2cc20N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5bb16b447771730eddff12f7ebcf7a084
SHA111f561fdf6ed1b0a767ee1b02251b51668204784
SHA256c534f65359b4c1f7b390747c995c839a0bfc6ba85ed0bfd097e7784f0114de81
SHA51202b533a2a4cc4dd565bb6a2bbf673535c9f3b10d3d86435a343639757c650fac3af0847bb2141c622b305d65e2934606d81ea148accb9f15a0c019925d257451
-
Filesize
139KB
MD54afbdac56ffece5a2195dc1b815ad26c
SHA10bb07ac47462489b121e4ab6171a9ed0e777fe38
SHA2560bb9853e4b2fb9b6e79a2261c5c0345c401b275950446e1b862afd9aab19e1d2
SHA51241dd20c9868e8825f0911b3c001ec78c726770d5726413239c09ed510e4ff354465c6449bb8fa0f9a2e14c44cd4960938e7894e548785ddaa4283c0fd41fc32e