Analysis
- max time kernel
119s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 22:48
Behavioral task
behavioral1
Sample
fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe
- Size 52KB
- Sample241005-2rc62svfmp
- SHA256 fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5
- MD5 a41438c0c5ba1e0451cfc0e6752780c0
- SHA1 e1cb0fd72635f25eb923bb8e87e082e7331faff0
- SHA512 8f1c9830fc53b2e2626a47129f84bf278a2252b2446a3429c7621ab2e9314e7413ae6c89abc17128f3539bef3fc6f95e85d782b8f018a41632cfe8710cfeb53e
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI97jyjWEWAnWA1:V7Zf/FAxTWoJJ7Ttyvt1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4659) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/5084-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000233fc-2.dat upx behavioral2/files/0x0004000000022922-6.dat upx behavioral2/memory/5084-904-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe"C:\Users\Admin\AppData\Local\Temp\fad759b93d6b7f8ab8efe34eaa74a8d99d9c04414080ce4bd6b02eb54be698f5N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp
- Size 52KB
- SHA256 2660dab73c2eeb89e94adc8e844f401e14611a3b2d13695320516dc73341c510
- MD5 e6b1d73bf6e919570ef54fc7f4bd8ea8
- SHA1 da7fe5e52dbbe08649a31dd82d725bbb5aec1ee4
- SHA512 6db736b9af19dbc2116b747267cd81bba514ff764055390c8869664b4d2d905088bd8bc6e0bfdf40e235f68feb1ae04ea77c8f5c93d977855bb2c7314d1842c3
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI97jyjWEWAnWAT:V7Zf/FAxTWoJJ7TtyvtT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 151KB
- SHA256 e73bb5cdbd6b0f183898a814643779af713d7bc9604c928a679c7425de88fb12
- MD5 f5a84acb84e9cdb4c404264f2d0752ff
- SHA1 43ccc3331f41d647db22195bcd14e9e3218db4dd
- SHA512 fe491999ce3d2da85add79c307842d511fad293b641f28bd9001d3bfc51bccef389e6187ff193a936ab1739eb0c664032b314a2049bd7f8d197442845486b985
- SSDEEP 1536:V7Zf/FAxTWoJJ7TtyvtI4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+6:fny15yvtjWHIjN3tj6qnv0b2UrXkbvLp
- MD5 SHA1 SHA512 SSDEEP