Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:39
Behavioral task
behavioral1
Sample
637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe
Resource
win10v2004-20240802-en
General
-
Target
637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe
-
Size
53KB
-
MD5
55ea72c5060c4c3e00686166e67afd26
-
SHA1
c45be02a96d971fec76870862948e1f5b5eda0de
-
SHA256
637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97
-
SHA512
a365713332259b323b8837cdfb3568a204b66543ddb074cb3ab0f8ef78a71aaefdf0f26da60b91ce2c111e286c67205d4eee7506aa644aa12c417c116789545a
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQ7ZVnEbisFhiXFharp:CTW7JJZENTNyavf73tQqarnp/
Malware Config
Signatures
-
Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2484-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023490-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/2484-910-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jre-1.8\release.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jre-1.8\Welcome.html.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe"C:\Users\Admin\AppData\Local\Temp\637fe7662560ccf1891459b8730570323d3ca1ce165204c550a9923dd1784f97.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD50b431d12b2d1d9c6be9130fd2d75653c
SHA13f05a16cbe431c7935d06855cd3527ab69aad643
SHA256badd370eac0d5536757721d4badbb431f67aaf53fbe4547240c6fc59aa3e025f
SHA5123a23323d271dcfc2fdcc43080fad9c19b96d1c83a29b3212b775d253e78915a750f2b61c6c4146e68c93534b11a05d2afe15d59d7bc6b5efd4dc2e5521326b8e
-
Filesize
153KB
MD54cabee066f6f9b07c47c6674b8d342eb
SHA1cdb018874435365b76b08855ef10a90e497b51fc
SHA256805c904dfb31a91847cb24c311562c2fcde4468633d2e7d5a83add8e5b9eb9e2
SHA51212d6582b9c27ed1d5cd6f653e6a262718aff8ae507af16b7ea47b2515aaf4b453cada630ecf5d72c54593ad9e5027c5a0a75c221121ca7ec07233bbc41ce50ef