Analysis
- max time kernel
120s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
- Size 56KB
- Sample241005-v583basfnf
- SHA256 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0c
- MD5 2d01f5fcbba6dc94ef0b4736ab7585f0
- SHA1 c082ef3ff1adcedfb21de5cd044d3183201d7d1d
- SHA512 6ee953d2864ba80343890702a2b3ca1c8740883e210824c0d93b90e19b3a9979531c6a08996ce4ea9706c5563ff20f1121c87890babc19994ee1968e1d6135f1
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V7a:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7e
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe"C:\Users\Admin\AppData\Local\Temp\6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp
- Size 56KB
- SHA256 3ca6810a1d66036be991e862ff3905665607ec052bf9d7c19e4c7a6b35bd3bdb
- MD5 09624e7903a16be8645d8db80e95c4f1
- SHA1 50d3eb3a54745c6d58b9808f6664bf4ec15a6fc5
- SHA512 42bd6ad89ae149ac0aa39e658acb6091d8c81b7b9e31d5487236b5e3be3b7de0835e29cd70c11528b3b7f3162a2120350fbf70e6021a5f211417437eabe8c69d
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V74:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 155KB
- SHA256 e1c881e9af7b8a232e66f881b33b5564b0e439d813ca81c8c6fd5f4eeb5d5ac4
- MD5 f82a030ca1c37154faad86fc4d82c6eb
- SHA1 289a270e818bc9229a0d238a9b270d39ddf7f183
- SHA512 78071761c5cf5228cbef02c9782f32bf2421ac798e492fe33e4ccd037b473dff2cd85e0f98e464d540e374feadb6182d36f23ef5ce2e4d07440edc7b5511c623
- SSDEEP 1536:/7ZQpApHoi4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddn:9QWpgWHIjN3tj6qnv0b2UrXkbvLp
- MD5 SHA1 SHA512 SSDEEP