Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 12:48
Behavioral task
behavioral1
Sample
df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe
-
Size
32KB
-
MD5
cdc2b1ae1dcb6645e4405de587bfcae9
-
SHA1
ee1250442cc63757b103a5addd6bde294321786b
-
SHA256
df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223
-
SHA512
2d6c241d89488c38f7164e4999476d1fcdd541b0bf6a56b333eaf1e32d4392cad1f66e9d6dec48d73e71eb09468b15b09582c4545816a3c9585f28ee4dc8ac0c
-
SSDEEP
768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKer:CTWx
Score
9/10
Malware Config
Signatures
-
Renames multiple (5047) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1792-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0008000000023415-2.dat upx behavioral2/files/0x00040000000228de-6.dat upx behavioral2/memory/1792-909-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe"C:\Users\Admin\AppData\Local\Temp\df308da391da6b0a85fc13d2cf88d8ca7f4a0f19ee1d1c6d6e5dc023e7dfa223.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD545f2f125f98bd96bedc1881ef194a82d
SHA1900b67419e70495269528d56d58ad1102b16a960
SHA2564958b3dd7d4c84c7754de1e524f792dc8f672bbaf6ba9f39c9b75b63017dcc61
SHA512f4822449e2a53ff375e1992bbcd83e67f07c465e3f94e1735a41e49ec5c5f5569c1645c51ff9e47bf8e4e03595f46edd8db05d470af83859ad2e7eff61999d86
-
Filesize
131KB
MD5bd3f0d0a81422e5b7a4dc22cfe251c5d
SHA16081e710b3fd532194bc15a688e11f40380a18ec
SHA2568c0b9bb1f880a89d357113e0a3b0dbc3fada531a20cca5658cedd6b44962e8a8
SHA5127bd9b970876621dba2242a5b9bbb04126734d4b193b6f1d3ff7a39c7d546733d0d360b084dafe428812c545fa92693a52df65e65c62fc7958d5b32bf71617a6d