Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:55
Behavioral task
behavioral1
Sample
1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe
Resource
win10v2004-20240802-en
General
-
Target
1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe
-
Size
89KB
-
MD5
96f4e3fbe4e09afb89f575e300c7a1c0
-
SHA1
3e5dcebf11c5e75f79e1c264f030a23e4293ca52
-
SHA256
1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1
-
SHA512
e444935c487fa7e835b71d8c79c3901fbe36717c90f5d107b4c5da7333f9a16c50a33202638b52f8b3d7e08264f5081c3c95f115c096e03d6e0aba5880b610c8
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZ+:fnyiQSo7Z+
Malware Config
Signatures
-
Renames multiple (5016) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3168-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000b0000000233dc-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/3168-872-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\AddRestore.odp.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe"C:\Users\Admin\AppData\Local\Temp\1d10f8959f1f44dee1db011364c357335211dd0b252c413db14c0fbdb04ac7f1N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5c66fb183e1637297c9507052cd6d98ec
SHA1da0c665936d8424e327cffab381ab369d943e162
SHA256747a7bbb5bc3e233342df19aeb097a52ba915433ba4f2a77b7fc7d35a62c7f7d
SHA5127f818047c51bceb11eae9e511c38f5011cf4a8d0e899754c4b89c433d2ce1b155fe28ad1ede1f54444641394471088d3ba9d06a85f71da66ed0a71c0774fe713
-
Filesize
188KB
MD535eaa6d8eedd16cf73c94191f4f132cf
SHA1911d140cb0a17080c9a8e9c33abe3bebea972ccd
SHA25608db0e63c9805e0a5c86921eda02677659d0f3ee705b79cbf0d83553f35c7b8d
SHA5124f989cd3c60e1f981c60ec6221f5e766112a781c1ac9891a45e71363f8afc8b7f0103e34eea81a43b872fa1317c91eb5baeb3ff04b22c7fc3cbfaf278d215172