Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
- Size 40KB
- Sample241005-xt41bsvbrc
- SHA256 d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501
- MD5 54868f68262c3e0f720a6061b52cb330
- SHA1 8b374fed7bdcd10094de89b81d6101900bb53366
- SHA512 ce50f17aa49253a014ad1ba1ea3492de3ae87b4dbb4ff1772c0341ffedc143a0e3d43ad71aadbd2e7e37c84e575683d7e8721892e220c28e0e3629c1ea7627e6
- SSDEEP 384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXavqC:W7Blp+pARFbhBgnKLMWK9WKD2N2W
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe"C:\Users\Admin\AppData\Local\Temp\d9410596dee59b92e823fe7e2f570f1a1e99acf6fe1c9f7bc63906634e0bf501N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp
- Size 41KB
- SHA256 dc4658dd362cbc59a0f27144c0316ff6f2a337e33d9edd29383e69979e089144
- MD5 d00af8b3d1b94ff09a49a1b0da17a304
- SHA1 dcb9b8ecc2b8334d539daa4fbf5834498d4a3bdc
- SHA512 a32fc44f99b980e2a176da594ff0f1b2f8c3baa1be94b0bcf3280342b6bcf635559f24537aa911b9b63cf0a1a42bf6fc53e7b3e8c0bb3253ef5d2e6c24254817
- SSDEEP 384:GBt7Br5xjLdbAAgA71FbhvU8g0U0fLMzyKbNzzyKbNWkq3DLXakq3DLXavqN:W7Blp+pARFbhBgnKLMWK9WKD2N2x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 140KB
- SHA256 0e3ba0f4788ece9466ea0d6f94700a6327a7cfa9ef4fa1d5015e56f987a9d6f1
- MD5 284533e564c156332d51d414afa62140
- SHA1 4dc79da0cd59897cad2055212a3b54826fbce599
- SHA512 7e1e8ed2a81a7b24b7b1e5b9e166d5efe505a248d88c6844a9cebfe92b86f854b3bfe46d0e29acff0e1109f54ef38b4fcd36e2dc3f10b13265a18bfa932d0b3e
- SSDEEP 3072:6+Wp2naKIKcWHIjN3tj6qnv0b2UrXkbvLq:AonJIjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP