Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
- Size 56KB
- Sample241005-wd521sshjf
- SHA256 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0c
- MD5 2d01f5fcbba6dc94ef0b4736ab7585f0
- SHA1 c082ef3ff1adcedfb21de5cd044d3183201d7d1d
- SHA512 6ee953d2864ba80343890702a2b3ca1c8740883e210824c0d93b90e19b3a9979531c6a08996ce4ea9706c5563ff20f1121c87890babc19994ee1968e1d6135f1
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V7a:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7e
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5169) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\DismountTrace.mhtml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe"C:\Users\Admin\AppData\Local\Temp\6f3ff94c39865a4d0a646b9cc1ee1ceb4046c5ea09435bc3cf09e10fe5802d0cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp
- Size 56KB
- SHA256 84164e6be14821cde7e11f86b49e99a49079d3c8eaa67bf59daadcf643d17925
- MD5 a9c1d28cf6647463d7cc0d496e18da07
- SHA1 31561059ff626227c13c8585dbb9a5a9ff61546a
- SHA512 3c68f571f30ae14e106570801873235634e90ebef61a75a400f36d54bb2486fc15589b4c154f914063c9211cef6d7da4cae6bfe5966f93fab1c16eda4d93c866
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V7A:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 155KB
- SHA256 e6dbf5a5fd8a23e3fbeceda13e8381ee1bce79278cdfb9441454cea68c8bdb4f
- MD5 df6fa00aeff22b8e230d655d14fe3db1
- SHA1 300ef7364c8cf062f1cc66f4c83c12df8037936e
- SHA512 f1daf97e4e6ddd935f5345893fe15d64e0b0682386b017800be843d19f116c7e79e8f764f4f0e94d1283365671a0ad068fa2d5257c416db68470992d67e4bfd9
- SSDEEP 1536:/7ZQpApHoc4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddn:9QWp+WHIjN3tj6qnv0b2UrXkbvLp
- MD5 SHA1 SHA512 SSDEEP