Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:25
Behavioral task
behavioral1
Sample
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
Resource
win10v2004-20240802-en
General
-
Target
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
-
Size
57KB
-
MD5
32eb6838ac2a52d3e4a34392461bf12e
-
SHA1
e593585f06083e56f282e478759145b98be61c3e
-
SHA256
8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794
-
SHA512
701559e785742e5bd7befb999dde7c5b872be523a8bff26e12b29494331105cd41a66e77ae708895b6163f9dc70ebd56c3fec1ec5b0062811eb0395e4a115a41
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIB:CTWn1++PJHJXA/OsIZfzc3/Q8IZTr
Malware Config
Signatures
-
Renames multiple (4896) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3904-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000900000002348e-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/3904-874-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe"C:\Users\Admin\AppData\Local\Temp\8278a4f01bd281ad207ce003ee1c53398c95c1b52ebe29dde3c90b24d6767794.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5fb8db64925e7df8dfea803ec1b89e41d
SHA163015681beebf66d00f74ba35fbd317aedbdde17
SHA256e3bc2dfd0594a67e600b644a0c05c29aa72fd7fe6e164080a5b474dc9d4c5ae7
SHA512993f2bfe4545952844459562a8512b1b89794d10fce0923dea113d856ab6ec7a20ebaaaa35bc5be3a9abf0838090fb46aee7791fc2a5a997838b10c3281301a9
-
Filesize
156KB
MD5819cf373e5b6d393f4836cd7bd06adaf
SHA12f6c85e6d86c8c394e74d97e96d9136f3b15a8d6
SHA25611b74b2cd2a26e2b6821f590eaa308baaad2128f3ed1df183e77263c36f0c210
SHA5124a5c0cc2198b4ec593f100cddbabf0288d0cc887805737eb27a3ede2cb7ec6e27fa82521e1e5d980eaaefa6720128bd48c0cab1745de9687279d77de7b9c1abe