Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
Resource
win10v2004-20240802-en
General
-
Target
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
-
Size
91KB
-
MD5
f1dccbdba6847dadf05cdef2ed710710
-
SHA1
a2dd483e654003e1b042be60693c3ce70e7f3293
-
SHA256
7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079
-
SHA512
4d34465c20e4d08d1bb6a12a3fb99622866c5068e105d530dda1f5620fc2df6f42083665e4171717604eda45464c291513d56496e6843a9b43d6772ad8b2b019
-
SSDEEP
1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg0///x9zK+:69WpQE0zxg4n3
Malware Config
Signatures
-
Renames multiple (4576) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe"C:\Users\Admin\AppData\Local\Temp\7e0242801868393ac2e24c42a980372c3d3653cd95c48e3b57e9fe06e4238079N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5b67c7a000e4f9d42a1bad234652e4b8b
SHA1044725a860014cd74638854a8aa5370e14167f47
SHA256ca91073c8a916ce59203b7ae1a886c6739e2942d78b6834b1fe2b73db3112e3f
SHA5127af044209b7d821061bfba68554ba84ff2947a31cc910c0611cf365e431c1b0e3c88ac9f3a8321ec738549a43374ff0de3a3385f89078dae6eda0f269b71d9fb
-
Filesize
190KB
MD553d117d151b535aae326395abdad2d6d
SHA1416be11c11cff6c7d62ad1d3f9359289a1b19dc3
SHA2567f31c2994317be39f7753db5dcd13b034525128f117e4b4bcfeff376c54f35a7
SHA5125a143d8aa209ff4af679db3e7d62e29e9c84edd1a67ed415b1d05569b99f3f79092d5cefa6dbeba44d6e69b49e8d5dbb85c0fff2103c0706245ea978c4732932