Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
Resource
win10v2004-20240802-en
General
-
Target
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
-
Size
45KB
-
MD5
66360ddcb10cb515ea6659cb23d524f2
-
SHA1
c3af28bbfe728ed256a13ae5f6cd72f47adff57b
-
SHA256
2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51
-
SHA512
7e0355084a490f0735ca05051c9a520e8e98ed356bae556a01b9421636c8cdd4e23c2457feb378f2dac2a7a6be401a7f93994ec1a54c6da721a8872fbda842dd
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/FzzwzgTAUAcfqg7Z:/7BlpQpARFbhNIg3
Malware Config
Signatures
-
Renames multiple (5120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.boot.tree.dat.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8FR.LEX.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe"C:\Users\Admin\AppData\Local\Temp\2dec01aa7ff47527cf96b0dffd7b8eeea41244c59312af967461dfab0a08ac51.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5550c08436afdb78cfff9169ae8058f64
SHA110d3d0c7ed89ab39c4d09aad85eb9a6a384acc43
SHA2561cbfcc0967a987084027da88c56f46caa13de152a49d87f0bc8c17fe6e03a054
SHA51295c06f6b079695c1b2fa8711d536993c3c94fe341e075d58701d4e30e739d133171bdd20dd75e6057e5a5ce0fac41981de7b5a882a072435b76997ff2d220ad1
-
Filesize
144KB
MD5b2b90f82542556ece3d96f436f831410
SHA18be1f15a4b0a8d1013a97842bb946569afeddec1
SHA25611f31186277a2446b5a36886bbe04c8a295b34a56b74305990e98d51c2348827
SHA51265452e342a470ff9b97f0fb392cb30e9b4fe192198c7339d438a84fc6dc15d2b31a5a10b8ac9b57a58578848ccc88d30d11fcfaefbf6d3b1d1fffbb33d1ae6be