Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe
-
Size
58KB
-
MD5
7ed9a827263e044aa583bc197aeb9de6
-
SHA1
fb32990271f5988ce18c033282124b32db0dc86c
-
SHA256
c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977
-
SHA512
203ce4bdaac49630e56a7c76c15aa782f8f3926f58b5d5112e09875ce98fea5162f49ffd6d129ac209d0131993348f27da433f24180e416a481d49bc34db3db2
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLMdrBdrcoKXOiJxaOiJfm:W7ZppApBULcfpHLcfpyD+pspA
Score
9/10
Malware Config
Signatures
-
Renames multiple (5208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\AssetLibrary.ico.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe"C:\Users\Admin\AppData\Local\Temp\c8c1cfeb03603f71bb9c7b7a6606ab29964a87721983b2e091fb75b3a870e977.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD549cf1b06e99d74b69abbbe28f0945569
SHA1cf5fb9a990fb8925cce50bf8a3fd932f98af1e3d
SHA256bb0880aca89a31f8db6b1b2b29e56fe6652fb8409e131bd44c4d183d598d9f30
SHA512964deff33c1df5046b77225ff04ff52540a691f8305ab5fdd5aff4f437cd57fd05302902cee48899838cc2313675ebc17d5d7932499d8a08c635d81f4039572a
-
Filesize
157KB
MD53ba93be5b2c6e9ceb0e29ba2ab6f459e
SHA11fa156c4073bf57b8f8252628768c189b1ecbdff
SHA2561a82ad2387d2b766525c28e862f95ec047035a1f32e11a683c4a821b876435a6
SHA512989b896bd4c266d1407553fc3bc0f9fd737fb995b14302b501f2e460231d5afc49e1b1e445f654648831af198424f904e0242b799250b5c19a4f20c4b8289186