Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/09/2024, 22:35
Behavioral task
behavioral1
Sample
ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe
- Size 64KB
- Sample240918-2hrcbawgpc
- SHA256 ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567
- MD5 e94bfed1f761567e031b1455b8101c90
- SHA1 d51617b3906639248a27d883cdde8d4b0155c85b
- SHA512 c53065fdf7ddec0629d03d83849e65c61187c14d420c596b5d4617f7a1e374ea09e06c95dff1ca268ec066d40b61d9facd0c92d24b4aeaace913563648b4979e
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Uw4:V7Zf/FAxTWoJJ7Tiw4
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4628) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002347e-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/2188-878-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe"C:\Users\Admin\AppData\Local\Temp\ef69478c37196efd7575581bbe6b9d989fa7e8b12250a52b019c10866bd85567N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp
- Size 64KB
- SHA256 2d901998a5f2005cfb6a33e8bb9048588587d4bc386ae904dba585768356b285
- MD5 f7472e96a9039378abe6106948b8c8d3
- SHA1 f5c7a59b1fb743af4e8a4be4d01dbcc80c93012f
- SHA512 f21e229aed11275ad220feb4bc137c2629650da09c57d60ba854a3a419c7e8de63064a19f2110d114fc32f9bea94fc2e501f077960928f67999ebd5d4c23ef89
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Uwb:V7Zf/FAxTWoJJ7Tiwb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 163KB
- SHA256 3dc4388208220293092a5e8bb1ee9631ff70193888a66addf80187be0b1b225d
- MD5 eaba5083d3b42bad08c885485985f0d1
- SHA1 cb4e34a44b254bdbd1bb03f2905f7f12deea72db
- SHA512 0ae09a08684fd19adfe284355b3046432ac4da663e111ad5d71b33f8f8f79cfd7f150b483aa6d1c740e62b1fc32de643c1dbc84a832b91ed54943adea5db257f
- SSDEEP 1536:V7Zf/FAxTWoJJ7TiwT4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0G:fny1WwiWHIjN3tj6qnv0b2UrXkbvLq
- MD5 SHA1 SHA512 SSDEEP