Analysis
-
max time kernel
60s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
Resource
win10v2004-20240802-en
General
-
Target
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
-
Size
62KB
-
MD5
2ead3c28410de382e0cb99df9fb6b641
-
SHA1
d91c097363beaa81f518e0268e4e8c72617338fe
-
SHA256
26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397
-
SHA512
175a7251af345b23a74a60b9d2bf05ede6dff351642987f69f0cd620d1ade4fc9968c4a9ea30b44316bf19695aa2865d79c75c6054f87ea4596f0362b1f9f215
-
SSDEEP
768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeM:W7ZhA7dAynMdyGdy7YRY4rhrI
Malware Config
Signatures
-
Renames multiple (1781) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe"C:\Users\Admin\AppData\Local\Temp\26923c28ae890904e9b763e8e901cb7d9244836b8fb527be722e8eae0aa38397.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5df22336120b6410a0187486c6a286d03
SHA1958ac4eb251820ba5bf05798a2857655e345b92e
SHA256b419d87b10f808282f08e58043a4b21872252c9dc4ca315f556a2eea1803844c
SHA51271098d95cd37788273c56daa012ec94778783274028713e976a997d139db56a0febf15fe6b0d94d7716f895c939ed481488858d1acb25671ca3c1c9bfd390cb7
-
Filesize
161KB
MD5a923d18221e991905f840812ff66a339
SHA19a10ef46b3a4a1d660a9f3b83b6f6b5d68ac63ea
SHA256e84cc4f65292d40d1e068db15deb10ca17b956d2152f47a97f23a56a21d940d7
SHA5125764f19cc3b8b03fb288464bdc73c82e8254b5527c50b6e47c332e9585488a8d234bfe8455070f1670fff04cde19291857812a3bdfe757928fdb66ccc546826e