Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
-
Size
91KB
-
MD5
525d87c6a2813dc051fb26bf460dbcc6
-
SHA1
ff238e721fc445d0181a1a5af3b29df2238d2d2f
-
SHA256
48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3
-
SHA512
09c13f152c11db4a3b3e46f16eeefa0e9898b8e9b7926df808440bf2eca4bf8b3f45be417016eeae69ab29ad45f95bfab2284a4948fb81e4d1d9bda8286ddf47
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh4:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsZ
Score
9/10
Malware Config
Signatures
-
Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe"C:\Users\Admin\AppData\Local\Temp\48284ce11f6abd3e61200b27b60af447c45bf52be7b92f2f847eb56379d7b8e3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5ee4412e48ce57254088e41856abeb353
SHA186151d881d59b6744a2785b9bb69141a3983f480
SHA256ffdeb97b19e54c297932034ff3d22d122e205dab2c740eab30c0c549e9310b16
SHA512c4cf899aaed6335cbedf2b37d734a02c1de22fe7da4af3d24731991ca4734cba13ea7e083d8f12dbef773bc7165abe54aa1c1fbe4423a03a02d3645496d1c898
-
Filesize
190KB
MD58845b02f07d55fff4c9d361424b7b810
SHA1d8c10e9b379a3945fc53d939e3c783f85cf4c5fb
SHA2563bedfae6dae1ee1efdc7d8614262398921bb2336d5edd6da223bb81edafc6aee
SHA512abd14f3d6fcadce849e1121955b25956d6074a15df38983a76967654543c6ecb890b2a2b0cd152c5c51418517411f912460ed8aa92af84ec37d1b747c0544e69