Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe
- Size 39KB
- Sample241005-wfzysayamn
- SHA256 d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe
- MD5 d47868e4504ac8941064cf4885be9403
- SHA1 1281041842130c15a059770c92ac781c778297a4
- SHA512 155fa42079e3cc5728aa57e1618f12a7003a1d1ea17aa95f33c324b094378ba561f668936e9e8470d6c468aa822526eee46f762bfe14a3464035da20382aebe5
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsS8:W7ZhA7pApM21LOA1LOl6vS8
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\AppXManifest.xml.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe"C:\Users\Admin\AppData\Local\Temp\d38030480115f816d241d6be52b3a9d9104722c55343d7a43122a91af28321fe.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp
- Size 39KB
- SHA256 37991401402f559929fdf3eb535fa7ad8bab24b62a891450e1bb203aa8cb9260
- MD5 caecc8c3ed18de6f2d647010510fde65
- SHA1 63d3da1646ed692e5edabbce91148d7262cdfde1
- SHA512 331363e3bac7c6f49fdfe742d7731ad4ac7be997b27f0283e045ee6b138f3444c8a7ca6d7d7a1d3059ddc74baa4e1d632be913e766f5252e5e97463e5f421d64
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsS/:W7ZhA7pApM21LOA1LOl6vS/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 138KB
- SHA256 22d5dd79b559abda348ca836709febf20a09ae0de12dfed3d49ac35c4bc6b549
- MD5 e458e031c91720a16fed868242f24ff8
- SHA1 7e03021d4f152febb7ff9e61797c27552b9f9283
- SHA512 f867d3f32e9aab7df436823505dd442e37885fbb363353895f938a5cb17a083d5f199e09b5dba80dc90fbe695daa8abe206992fcf5b2101cbbd66a235f8f99a2
- SSDEEP 3072:6e7WpMgLOiLO2SLWHIjN3tj6qnv0b2UrXkbvLh:RqKgLOiLO2S4IjNDv0bNXkbvLh
- MD5 SHA1 SHA512 SSDEEP