Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe
-
Size
60KB
-
MD5
5ff19500ea2a6f8c323552c5bcc3f073
-
SHA1
f7138b668ade31bb343e25ec84de3844cce9d4e5
-
SHA256
99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214
-
SHA512
b024266407e1043505c0bf726c384bcd73427de88d5e328d507d0d02baa25504b851da3eda000f5075209464a96813a77fea8fbde598d7f48b415066ee97a28e
-
SSDEEP
1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFs5j:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsL
Score
9/10
Malware Config
Signatures
-
Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe"C:\Users\Admin\AppData\Local\Temp\99a4a857a2d175e3973404ca2efaa6addda5d353c88cc081e9266e12b9b9d214.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD59940b6e3fd1577d75f9793f1e9c968d6
SHA1da7212af1cf999afb3497854bd2ddca683068dbd
SHA256e6d1a9690a5313c41a19f9a3d432420bbe9d9df3d9e91a78e5e8c541518ec34b
SHA512d6cfae80e942f2ae83ec8b9df08cdb99c66bfeda6748de526b32f8bd9b8220c2845382b5110cbc962f34799548be916e50bef8168b39811919a0a1e82964ce71
-
Filesize
159KB
MD50ed7f280730a2db4759e503ab868f159
SHA1ffc5e1a1c35e7864483b18994c18f7a975f0ae44
SHA256985bef9e20233179c45cc0dd2552c9f42019885b09fbb77f81a016fab33681b8
SHA5127e3fc432c02db3d54aa37ef0ba0b6febf2827333b5c559cb156ba75c91fe826267fce768fa24be4ee3a387c665277171237b53070571bd19ddb766c1a4411884