Analysis
- max time kernel
120s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe
- Size 88KB
- Sample241005-2ms2pszclf
- SHA256 b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56e
- MD5 a020377954ac0d39eba5a48858690e70
- SHA1 9db4b5508725b92cac3612603890b3c271ff41ac
- SHA512 1cf384395ac86143381474102f5cdf77fc01a6a86e91d0f28507dc20a17489b153ee93af1961460919b8a9e4c7d90dcad10dcdca5b8fa7499c3e4396effb6337
- SSDEEP 768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw2O:/7ZQpAp/Eaiax1U
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe"C:\Users\Admin\AppData\Local\Temp\b45f561d991f1bfe5213685918433e91e6983c6d81a9c42e0652aa4ddd9ca56eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp
- Size 88KB
- SHA256 c64db20d65244c54a3e0d23579ff8b30cf89fd50769ac13849a28231a66407c5
- MD5 00f9c14cb01b1fee13b3c298a4d68482
- SHA1 5fb8d856bafa7e9c81511d9bb3061cc330d2c967
- SHA512 655d61e374f8d85b4a6a67873edb3e7edee1695e9230d733ca1e4470675d03e2dd2a735bd3125f2f753d427372f49e604d26daf3205195b1c27a4b83c666dfe7
- SSDEEP 768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw23:/7ZQpAp/Eaiax1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 187KB
- SHA256 46fbec0535c848982e080d7ade1ac18c77852cadde8668ff79470f956593a37d
- MD5 1525f3635eb2e8f68b1dfed5bccdbe6c
- SHA1 4f19de0a4b84a8b788f0660fd0add387eae13d7f
- SHA512 7b96721f61ee3e47bb421d6eb9ee66a8d88720ed1d1673449d31bbce1841f7a2598a2ac5a1d5287b78ede8ff4846fdb95f3ecb8116e0b950cfe020d0be0129d5
- SSDEEP 1536:/7ZQpAp/Eaiax1u4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpY6:9QWpnWHIjN3tj6qnv0b2UrXkbvLN
- MD5 SHA1 SHA512 SSDEEP