Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe
Resource
win10v2004-20240802-en
General
-
Target
156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe
-
Size
50KB
-
MD5
4e2b6c7cdc7905d26748c7f2b447e069
-
SHA1
b0745f331262c347c373ebbf880de38545b02c17
-
SHA256
156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300
-
SHA512
6f38afa56ae170fa492066204e3c4da9d50fc1e7ee7e2cb4ad46eca583b1fa6b36b9b3d24837d2e2a9d987b8484a51e9cda9862392b7da43559685af0d98038b
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfpRo+fOiJbfo+fOiJbCk8t8QP2Hbww9ySqbw4:W7ZppApBULcfpHLcfp/ZeLP27wHw4
Malware Config
Signatures
-
Renames multiple (5009) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe"C:\Users\Admin\AppData\Local\Temp\156025bd1b43d963955f4f38a4c72d82692a82fd3a1d8a3ac7673563d94d4300.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4452,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:81⤵PID:1004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD51b54255dd33e2176151f22343376d854
SHA1ec6250049521f8d1b972b6dc6f3d6136e404f904
SHA256d0879f735620116450155fe93604cd55102e036479553c13119276113c8f6e57
SHA512105321730e80443865bcaea17770d23ed85f898d6d7d639dce36bc901fc828913ef51689d785244c172fde981f07f369d710165cffe5e367acc72983471cc851
-
Filesize
163KB
MD598b1a0b0b80793c1674d2f2810c56b9d
SHA1a2abc68569be468e9d3fb030fa66960c7ee4c6ec
SHA256f350bf5e87f9bac9c69a25e1c8e8e5fb476f52b0ae827bd51788ef4fd3c74d41
SHA5129777bd4fb4b6ccce62f941f952469f2f61094b2b82fea1396c6ab51d23cb576ff9c2e3f25a8a8ac6aeba248b1c37a5d9177d8adcfb06ab6070581b82718ee1d2