Analysis
- max time kernel
119s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 22:24
Behavioral task
behavioral1
Sample
9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe
- Size 59KB
- Sample241005-2be1psvckj
- SHA256 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52
- MD5 a72a6f0c983e685bd793087467eb4c40
- SHA1 b2e51595f659b0978624307b14ce7e21d96ff255
- SHA512 a79398f358439e81248e9ea406fe33ca300d0122dd0b208314269d9a14b059cc5d4e95f06dcd6fa4360315759b2041276eedaed752f98aecde54169062b7b9ed
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJ0:V7Zf/FAxTWoJJZENTNyoKIKMm
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4671) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3024-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000234a1-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/3024-910-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\7-Zip\readme.txt.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe"C:\Users\Admin\AppData\Local\Temp\9803e93dd42b08961a2b937648ea5e09b6a2b8ea92826a4601522a5131a46b52N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp
- Size 59KB
- SHA256 44551e075a652778bd15d9b8a2da67f21139dfdc9d19c1295018964507923989
- MD5 e3185ff115a9206962a566ef7ac1e42e
- SHA1 f46897caf0f38c8e187be5c6daaaa8d23b3360a0
- SHA512 443fca2bc610ad1d00cc9efcb246bd8f1b3bea08f234e3ebfa48c90db40ebc700d2716fc48c45d1b9864b09d91bf6cd6cfbef9e74090e7af68ce7f52da717587
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJ4:V7Zf/FAxTWoJJZENTNyoKIKM6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 158KB
- SHA256 2341c8d126b031560f06d923a1291d771fac5a86f2c9f831d21ff53734a865dc
- MD5 496ab87960708fbc4978fd959f74ce41
- SHA1 7af0117760a9f848d9dd726caf0991531b1e1963
- SHA512 8891b03fcb291a715194ef292a22c6ffe84402ad5597d0dc21b5bd8ce1a72dc91e4e995591b67fc6cdc188d0f8aa8835493c5e806b0c31e01f47221c04b53fd4
- SSDEEP 3072:fny1tE5KIKjWHIjN3tj6qnv0b2UrXkbvLh:KbE1IjNDv0bNXkbvLh
- MD5 SHA1 SHA512 SSDEEP