Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:33
Behavioral task
behavioral1
Sample
ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe
Resource
win10v2004-20240802-en
General
-
Target
ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe
-
Size
76KB
-
MD5
337db66c9b14cfc952d3fa46b5cd6270
-
SHA1
799c58de07cdb63addab128f230ccdcda900194d
-
SHA256
ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373
-
SHA512
1563d8adf25683178e99cb05b825d8a3cb739b2380066f61c7be0a68595087defcbc44eb2781e70059c0e3741f27d41a93e9c78af9c1d87b14122e9c1e2aa93c
-
SSDEEP
1536:V7Zf/FAxTWoJJ7Tx4PN54PNvpJzpJ0+LG/H/yZGMF:fny1EWJ3z30+LG/KZGMF
Malware Config
Signatures
-
Renames multiple (4365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4768-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023622-2.dat upx behavioral2/files/0x000600000001690a-6.dat upx behavioral2/memory/4768-856-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe"C:\Users\Admin\AppData\Local\Temp\ec17bd5a1137d757c2ad04d84afd1d2490a8d516279df71f9acaf56d791df373N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4768
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:81⤵PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5e1e0ae3a03c0f67cc244fe0c6fe09433
SHA1e2f8d15617826c4928a869fb71eeba49f13cee07
SHA256711a34968fbf60af781c195302509c3f4e30413cb68ad129bc4ed427f5017bd0
SHA51203ff6eaf3cf68140bac52f398aef3e6c0bff53d3720408bcc345b12072a2ac31f5f65449bc3eabdc05be19c1f3915d2149a1f9624ecaa6ed2520a63c25859734
-
Filesize
188KB
MD5788bacc8a2d57bbf4fc57689425ce9d2
SHA1676dd8087f19bff43bf60b38b69a28c38dc71be7
SHA25657deede9d94c8be66c4636d163b762eb7d1633006d2221278a79d30c7242e26a
SHA51240e71a15a277a9afe86c122427e17b4321af7ddf9ca4d4247a92c06c1920482ad1e9412f6e6175bd15b4cb488c772488f53b03a9ddcc3a029df789f8dab2e409