Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:38
Behavioral task
behavioral1
Sample
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
Resource
win10v2004-20240802-en
General
-
Target
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
-
Size
90KB
-
MD5
4967679a3813496c0dc3752f310dcde9
-
SHA1
23f41a02864f3e4227b175bcc5de00be48cfd744
-
SHA256
27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0
-
SHA512
1f24a0027aefa6309a6162789ac0130063d3ed3398e381cce33f7030604c886d1427b0c1126e3adb592293e16cc8bc4ade95697f193de4396d1f4ee061fc7276
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5Kw1qS:fnyiQSox5Kw1
Malware Config
Signatures
-
Renames multiple (5163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3152-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000233b2-2.dat upx behavioral2/files/0x0008000000023410-6.dat upx behavioral2/memory/3152-908-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe"C:\Users\Admin\AppData\Local\Temp\27a6e753378b70d2da82246c25ab18966fa5fb5e1124cb8ab62b534c0d9555d0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5e7a4479703f32dd2b84fbd350306dabb
SHA173c0579c065f5a71a0b3db8e9e38f54c2eb90057
SHA2563d6d68c58b6810e870591f12d7e5ac1292fc68a93f3c3a27ce92c7570bf9447e
SHA512a1b3310b84f5d8d10545b5eaae17ff177c4f32a7c95435df50754c98292609b1dbd67898569073f96c468085aa877bcf4e5173e690ed31c98ab89c0c98d34eb9
-
Filesize
189KB
MD51ce59150b56936145681fc60e30f3395
SHA10c5f40bdd344420df6e1d839ed27b66fc61c8c45
SHA256797cadb1fc66d1c29fe2e7e74bf16b88f95e9059a955583f832429baf96771b6
SHA5126b873508ee74c9a38df113a865ea7fb326d3540406d471f53d58a73445787359a7b9416a1a43272a429731af6d95c092f021bd46dc7889838377fb340cd81701