Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
4a43b8fcbe0e2114cb97d0499f531d30N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a43b8fcbe0e2114cb97d0499f531d30N.exe
Resource
win10v2004-20240802-en
General
-
Target
4a43b8fcbe0e2114cb97d0499f531d30N.exe
-
Size
45KB
-
MD5
4a43b8fcbe0e2114cb97d0499f531d30
-
SHA1
2e928d0c038f9770ce851067691c8e9d32fdd8dc
-
SHA256
5a927c0cbe7aefb57e8c3c5390af2492db6c8fbc14616f8e394dd90bdc900ad8
-
SHA512
28cd216ec04161ae1b6bc0ae5a26da39e8c1ecbc2b7584462fcfc217c52dac7a18bbabd20e8195e497f19ac2a3aa6c4327222c09bf5fa92d8c559eaec4a5ae43
-
SSDEEP
384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXOIwX4Iw5:W7Blp+pARFbhBgnKLMWK9WKD2N2lWrWp
Malware Config
Signatures
-
Renames multiple (4642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp 4a43b8fcbe0e2114cb97d0499f531d30N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a43b8fcbe0e2114cb97d0499f531d30N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a43b8fcbe0e2114cb97d0499f531d30N.exe"C:\Users\Admin\AppData\Local\Temp\4a43b8fcbe0e2114cb97d0499f531d30N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:81⤵PID:5528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD59e66041040304fbd5be6812f0052984a
SHA1db323b86a25c90ade2f2b58a625bef7f1040eefa
SHA2568ed1a94799f477c0196c250eb5b28fd0395a1e12f810d2bf6a6ad6143afcba9c
SHA51288e7a93ed0dfcced5ddc7166712fe69cabe2a559a46aa1421768883323fadb46e00461b54e77ae4c4f5008034e8a9f597bf3458629f9e1a79ef28caae4d8ebb9
-
Filesize
157KB
MD5d08d7e20406d801df7568806572f360f
SHA12e882067f490261f7b7633c15e5e57b794e77640
SHA256cc9b24d58f53f8f28c4ae5a0564835e01f36f1b1d650dcff9eb633a40fe9d213
SHA512531525facdca006c7cecc6af909487ed3cc98c0420f702815cdb7eb639cf6c8e8e531e9736c00d1a362ae74111c7183dab73233d1c89e5eb3ab3d113d2b9b019