Analysis
-
max time kernel
119s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:32
Behavioral task
behavioral1
Sample
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
Resource
win10v2004-20240802-en
General
-
Target
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
-
Size
61KB
-
MD5
639036273e53d4aa2d70bebdf38e0390
-
SHA1
9ab95eb83018a8de919747a6173f4b5d058fc470
-
SHA256
a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bac
-
SHA512
38c15cd7a72ad9071930d6263ed99ad053e2e53361a0b244bf21973585ce5bdd32694b1efeb5be9fe30ef10873d310f322873135a5bab99c612cf04c5f889ee6
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBApwp133EskmK+:V7Zf/FAxTWoJJZENTBAOIfmKJfmK8
Malware Config
Signatures
-
Renames multiple (4625) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3960-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000a000000023473-2.dat upx behavioral2/files/0x0004000000022922-6.dat upx behavioral2/memory/3960-902-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe"C:\Users\Admin\AppData\Local\Temp\a5e50d1020a50106c3dac90f8844e5e9274cc2da9cac72f377656d1202802bacN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5641850286b21d67f95957048224473a5
SHA168e9b0a9371f21e099d3563a3bafa3f7d0b40e56
SHA2569c72cde3444d7fbbaec17904d49215990495fbed3b6ffd2ee608181c11f4dd7c
SHA5122d99ec6caa12942943a7ca817fcc3f2fbdcbbcef0b8083237dd521638298bdfa4e3fa389cbadbb3d6ad3be1b975cd1ebcada8671607cd81e0e9f28a45ec51632
-
Filesize
160KB
MD58b3c74cd021f1c2d40aaca24028418ca
SHA1ffd41cfe3e05107a5a6ec288e05079da12500f6f
SHA2564a73f6f8685a761056fc7c707d2718102cf864f1e381b1a81d660a548d468e5c
SHA5129f63858ea34f2952b675c6283dd6a54f3dc91d1befbf3de9ceb72a72a6592af78e7241a4ef2df89410bb46c88784288a15510c7ad8f5c2d84432101eae61a622