Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe
- Size 94KB
- Sample241005-3ae5rawbmm
- SHA256 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea
- MD5 412f68dfd807c9e93f98c0465cd06870
- SHA1 cb1212a76922c78796ab6260bb66a2ce755e4d00
- SHA512 59179cd6bab39af796b93c5987675148f094bfcf32da427f5fa6d7524628cffd7e06277cdc2d0bf509eabfac05091b5d87b1ca96b00ce56b6005e6d97f76b18c
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYjh4J/e8J/eYTj2:6e7WpMaxeb0CYJ97lEYNR73e+eGGX2
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5030) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jre-1.8\LICENSE.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\7-Zip\readme.txt.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe File created C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe"C:\Users\Admin\AppData\Local\Temp\7de00900bc6339d69bd35d59b0eea26fe05d9da32998ddffae75e028c755c9ea.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp
- Size 94KB
- SHA256 ce9dc55a00a26912d8c11987f70e50a1d62395824c6c0907637fa63a5d86997b
- MD5 e1a859eb3fb28403d6bd8262f8a52a59
- SHA1 2f85cc38fa6d34a6f8e5d7dceaaddb01a324f87e
- SHA512 c9af0ea70e325af1b781f2bbf2331d0336f98ac21e873b0db82302ac5e9b2969ad6197fa73f2b47df83042e07df2c285883daf2b86e801fcf310c6b1a96618e8
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYjh4J/e8J/eYTjF:6e7WpMaxeb0CYJ97lEYNR73e+eGGXF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 193KB
- SHA256 85043ebe296ba4bdfffcc07b1471b65bff3d80493b114132cff7aead3c1afd6f
- MD5 74896e2b65e194091aefef556bf88516
- SHA1 d830f98cf680bbe87adecc6df79ca16476c97f7f
- SHA512 46b6ea94bcbae217c4de3229d8a4294eb46b5b69933538c08e8e7e529b69b98ea847b556cb37e483e6560a6588034efbe6b552aeb58e2abc636da25c4e3a8678
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eGGXvbWHIjN3tj6qnv0b2UrXkbvL5:RqKvb0CYJ973e+eGGQIjNDv0bNXkbvL5
- MD5 SHA1 SHA512 SSDEEP