Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
Resource
win10v2004-20240802-en
General
-
Target
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
-
Size
47KB
-
MD5
8e600b552764dfc4949d79eab5806a73
-
SHA1
edc84f1276bf01ecd3227e0af771cfe0cd978cc4
-
SHA256
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117
-
SHA512
19e115df128825c314b968bf08cea2129719c111e69c96eb4619e2f8e4b1137c220f9b3e4f75e938d9cd7d4fb540c85876f41580af8f878543e4e2068bd0c9a8
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c53hmYoYI/KHI/Kr:W7ZhA7pApM21LOA1LOrtkpt6uYoO
Malware Config
Signatures
-
Renames multiple (5204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Google\Chrome\Application\initial_preferences.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.boot.tree.dat.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe"C:\Users\Admin\AppData\Local\Temp\9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD506c49e52ccb6485ce0748961bcf52fb4
SHA1a533aaec62753d197da958b512c1146493ae7b23
SHA2560376dace64b2bac6fcafe448f4950246dbd88e4f8ccb4e5b20a465cf288de08f
SHA512779f5db1bcc06f9fa0651ca56874e6d3678603501719cfa4d5abce53cd3ddeee5c6783a36fd8568d8ff5d4d0365c56a3f0e8127fe42ce376cb7b06b5ea9932b4
-
Filesize
146KB
MD5ac71947bd8a48d6ef552e36741b570e4
SHA176def6616a6e6f702ab77517a479cac946ee7ddb
SHA2560c7d82ac6d4fd85b08a505078338fbb6c6a36f7d9fd7d69c0dbf6efd84bb6f3c
SHA512c80e117e7744ec4386e277d0e74f80bdf1da7e4005f80ee7dd052dc3d284f49519763d81dd6830a7b7019980880d5926d0e45d06d56f3f9c3b0fbfdd9ca12d29