Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
Resource
win10v2004-20240802-en
General
-
Target
317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
-
Size
51KB
-
MD5
6c9e8cbcbd9f9302f597fe0cc10a05e8
-
SHA1
bfe52a05dd8af0c74fa412b0170adc3b917a852d
-
SHA256
317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84
-
SHA512
6fd3836af2c3988583f3ccd69325ca03e737d764a86ad3c691397417235593219f124056ea12e7f70f3fc7498984553d934482463726e40474c2c0f2c5055887
-
SSDEEP
768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzE1IwScIwSWF/MF/y:W7Z2sspAp5YSfffMrfr92a
Malware Config
Signatures
-
Renames multiple (5196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\DisableUninstall.pdf.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5530d02751e6cd6678bddd89baccdab9a
SHA16130dc1892c52e43b8aa20fa5a334caf6e51ad87
SHA256460709b2c61f46ce0bb227c897998389c7dee4be772405f7d5c6a9203d836187
SHA5120beb303dbafa54f146bb16078d4228804a76fbb637e560d017c0ac0008d1b3ed0852874e9c19635b0a75fb45df768e4b8ac230b2e74d79d1fbb029b079a60b59
-
Filesize
150KB
MD5adfce96647e669199ca95f195293c04e
SHA1b271d2cb5292b813688c1966d1fc080aea00671a
SHA256eea19220166a6cef28c6a52e0fae0a1ff1f123bd59014e48dc6008eb54d7101b
SHA512e5046c24c4ae34ac3f75411d7b5a6b752981a3792645ea443a95d8dd289fd315f6b4c71ac63c4d87a51e2c21c1ea17a66da88683425eb646178a48a59ebb6d56