Analysis
- max time kernel
120s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/09/2024, 19:54
Behavioral task
behavioral1
Sample
55541c3ccdb8e617f2499c4074be60c0N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
55541c3ccdb8e617f2499c4074be60c0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 55541c3ccdb8e617f2499c4074be60c0N.exe
- Size 64KB
- Sample240905-yms5xsyblm
- SHA256 5441ccd4cab23ad61bc96e5a763803839a21251d20fe4d89694b706010efd8ee
- MD5 55541c3ccdb8e617f2499c4074be60c0
- SHA1 d8ab1d16a34e732e13639508eabfdd102ee021f6
- SHA512 c419cf034b85205d115ae2d7e54023f19b00f89b0c30560f900a026bc51e5c859dcd79562d94e5adc682893a64a3c02c69f8a595a435ba2303c2e9b1e951adea
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiTBRiCwG7:V7Zf/FAxTWoJJ7TTQoQvTwDwl
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1360-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000234d8-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/1360-860-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp 55541c3ccdb8e617f2499c4074be60c0N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55541c3ccdb8e617f2499c4074be60c0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp
- Size 65KB
- SHA256 a00a78ccbbb288c7314e3628d54d2610ebf4261ffec236192809f8e7d45de15c
- MD5 d684ef55da92a56958cc428829d515de
- SHA1 6ac96d3c913211ce81ab8d6e4153d64c4f88f4b1
- SHA512 56c0f7c1179f6787fcdf22fe4116e12496c619ed0b0b2b87059c1d2f6fc61f20dddee09c07f396391741d26ed940e8af09054568ea97dbb04acb7ff49f3168aa
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiTBRiCwGU:V7Zf/FAxTWoJJ7TTQoQvTwDwq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 164KB
- SHA256 e0a8c4f5a00383135aa75c151f67b733577c9fd00558e2c4ad1f215293fba91c
- MD5 d51d217c6e3016d34bf9861a361a4e0f
- SHA1 358c43af9d899485266bdd86c11ec11d40abb809
- SHA512 fab0445c4ca291513621bebcaa9b746f7f88c224cf6f08520d0f3b75c5497ce0c9c246440e35137492cdec348818c74079c8676e7d992f78a2f5f56f1763a5b2
- SSDEEP 3072:fny1oRLwDwQWHIjN3tj6qnv0b2UrXkbvL9:KWRtIjNDv0bNXkbvL9
- MD5 SHA1 SHA512 SSDEEP