Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 20:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe
- Size 48KB
- Sample241004-yyscrstfkr
- SHA256 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02
- MD5 d57c93a5d8a22773d26c1f0180b09729
- SHA1 207ada5ac39b29723191da8137035b2f7dc23c14
- SHA512 c7de8bb9614a1b77fa6fc28e1ff6c8898d60cfdd636ee135da5ad14b947c7b619aa81c936b9d3169baf600556c82b10e5576ed76cdbca7412756a8b85c0f9783
- SSDEEP 384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WFeY:W7BlphA7pARFbhvOsTKnKqtmeY
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-LIGHT.TTF.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe"C:\Users\Admin\AppData\Local\Temp\2fa0a77445dc94d01dfee968fc849f1b5dd86e3368f71ca7e1ebc2afa7db1b02.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp
- Size 49KB
- SHA256 ffce5c760d3860bb2ae84a067a2996c6e4b756bc15be25d181ec2eaf42855af5
- MD5 0d09877e78483dcfd3db6c26e299630f
- SHA1 e2cc71a791fe9683f7538a5ffd4e27bb7659cdbf
- SHA512 335c09797506b9fa5a917debe74e0ef5f63c13b18577f77792943129a772ea381dfa65e3efea125e9f34676a607f586ad1ac873c1ea55e49b17192fe14cd31af
- SSDEEP 384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WFeS:W7BlphA7pARFbhvOsTKnKqtmeS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 148KB
- SHA256 ba0c2329cacb83e5982120d3012ad6b21e269bc9507417f49bea7a74e363d28e
- MD5 c11b3667d4051b762dd6305a2104d700
- SHA1 672cbd31b81756884a7f29c2b39766a7e4624266
- SHA512 1b6e9f65feb090c3380cd5e2038a502e0fb89fbdbd6bb765a76329f4c3edb6fc358c00403d4467a0f2582482a077abe1a0326209e6ad201f10eb2dd24ca90c65
- SSDEEP 1536:W7ZhA7pApvOsOK04pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYZ:6e7Wp5WHIjN3tj6qnv0b2UrXkbvLm
- MD5 SHA1 SHA512 SSDEEP