Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
Resource
win10v2004-20240910-en
General
-
Target
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
-
Size
42KB
-
MD5
d8315bf38f859f5b36ccc8a0765e67b0
-
SHA1
3747e5fbb5af9e9c135af3690adf6a98ff42f403
-
SHA256
c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347
-
SHA512
70b5754b5738e81d0bc3b3b7a4e4d3023a4bd729c5b319510b0a3d792b622b4414762263bb2c9e11780c18349b62eb42b09955655a97219e619e05468b2cfca8
-
SSDEEP
384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIr:W7BlphA7pARFbhL801VvM801Vvv7I+J
Malware Config
Signatures
-
Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Crashpad\metadata.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD544cad91a39dc07c677dbb569238a17b5
SHA1877053e3f63219b4a2c9209b15ccf9fe28bcadf5
SHA2563a9ce9cf3dcd6235ba26243caa89640ae35cbeb34d04afaaefe234e5c7e53486
SHA5124e58fe042b6d5461aec9e716489855010e8bfe140e6a32d76050335024665822707aff72a4d26a645e89afa67f8fe1c5210a5a33aaf52d65263d3af095ff3e0f
-
Filesize
141KB
MD59f31d93db646e367ada1bd510f03a836
SHA1928df1cea3e3808c01b0f29be1795443acc1fc7f
SHA256193ab58fabf732b77fe992cc04a929da9df375b3bfcf3ac1b67fb9285e06f6a0
SHA512f4260e2c1b8b5e72e3069acf1edbb232a7da355adc389517780b04b9ddb71b48fa9e1f35594ac45a6bb0a23bf31b265201c3619c584b8d0f8aa25fbf166c6f2a