Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:39
Behavioral task
behavioral1
Sample
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
Resource
win10v2004-20240802-en
General
-
Target
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
-
Size
29KB
-
MD5
464b21a55dabd603775288482ffdd1ca
-
SHA1
33fbc0a920f64339b6e718e4b4939e7bd29abe42
-
SHA256
036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72
-
SHA512
c6fa72535b06787585dfc62fc890d39644a60503ef10f1c6acb236688143b2b6a1d92bfacdb6e8ac05e75e958a880b8a2f88e85dfb3ea5722e8f5432252855b3
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9yVz4QVz4C:CTW7JJ7TgB4QB4C
Malware Config
Signatures
-
Renames multiple (5328) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4632-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023480-2.dat upx behavioral2/files/0x000c0000000220a6-6.dat upx behavioral2/memory/4632-1086-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEINTL.DLL.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe"C:\Users\Admin\AppData\Local\Temp\036bae17ebd20b48963ea239df73542ccb526855d4744004e9b46899fef3be72.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD59bcd8b260e5c8a1544bb4c2e981288f9
SHA1c103add360088b659ba832defd90e3165a257018
SHA25648c7d6a491e183e3f53a50ff5098246f808c88745293366fff0b8d1b5e11baaf
SHA5126ca12fb8423edb336f624101f094a3ed6106d4a52a35324c3ebe2d5d5b6a54c511d4e1f839777c38aca796c3fedfd4f94cda5d05637bac7dfc7457d75a1a90c2
-
Filesize
128KB
MD5c1f71f0a098ad7cb0379692438dc4f9e
SHA1246ba62b1cb199d95a4123ec3358f4ca7283fbf8
SHA256bf3404f16846ec7dade17399b4c440bdb2fa4fe341e5be20773b6acec3efa113
SHA51202d59347c4eaa9846598342c497d41dee6fc0b0051c7a275d3366509f65b18f89bc351c07b4f315a03331572c2cb72e37e3c656b02209aa3fdd5c5353de2cb30