Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2024, 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe
- Size 77KB
- Sample241005-xx2pdavcpg
- SHA256 db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58
- MD5 4d77dbf0867de3c5140ff362e960bae0
- SHA1 5e75c6447f268cb92cd19e63c9778aabcaa5ecfe
- SHA512 c71d124aa803132c84e65a5778bd71c82af58a1a2c967f8a913811a10eafdaf885d812c83cbe19e9261ed6c8bdc311cdd73dd0ecf651c4e3fcf6099c84e4c506
- SSDEEP 1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwEa:62ssWpcU7lK1lKgka
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4952) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe"C:\Users\Admin\AppData\Local\Temp\db5ba2cd79e3766cea8b0b130321d8b67af02b8a889d1cdf2d7ade0f6e13de58N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵PID:2328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp
- Size 77KB
- SHA256 e509f48ed03fc0f6ee63acdf37edaa835beff3532370b6c236f538109b9057c0
- MD5 9cf6c72f07bf51758c4f7a3bc4f64e64
- SHA1 f2db4676f21e02966e5c8e4975c0aaa349d75fbc
- SHA512 93df47506e4a855f6837d33bb5a26293d6975c2c6d3c2e0e5b0b4f01347173411c4b671ef1395801fa84fbcfb85b861bd2753f2e1b4e73232283929dfd752755
- SSDEEP 1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwED:62ssWpcU7lK1lKgkD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 190KB
- SHA256 bfd738b38eda10ad7f12fdde27b41f3986b73eeb85cf19701ff8c75d1a5fb3ff
- MD5 6ba0660e9020123306a84cb6c71da5f0
- SHA1 bcfe83d3e6d21afce31281c287200f4038cb9094
- SHA512 19335e949b7c48a960e88cbc86e6cf26b3fd1f4eb9c7063444d17974f354df623ef8af394f9fc6f4c5fcc255846b925bbd50f354015b592101a05c1b75f1a60f
- SSDEEP 3072:62ssWpcU7lK1lKgktJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPC:MVyU7lK1lKNJ3a3LXGZkUcTb1JcrjQ4c
- MD5 SHA1 SHA512 SSDEEP