Analysis
-
max time kernel
119s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 20:00
Behavioral task
behavioral1
Sample
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
-
Size
36KB
-
MD5
3d1869a0c38b13e8e469225bf6098110
-
SHA1
bd6dab87cc7f33e86b19548e45ecc5a8f66e767e
-
SHA256
ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0
-
SHA512
2912b639aa84e184c49497842585195765d9376f3965ee0eec32e96cbd69d1e6e77eab2299b5ceaaef14c302c5af0c6c80e9e79d0b8362a7972dc05998068279
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/titPdP6:CTW7JJ7TTQoQtFS
Malware Config
Signatures
-
Renames multiple (4679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023463-2.dat upx behavioral2/files/0x0004000000022933-6.dat upx behavioral2/memory/5004-1013-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\7-Zip\7z.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe"C:\Users\Admin\AppData\Local\Temp\ef0e45386099ac22d091da175ab13238372fac83448424046d64eb535349e7d0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD51ededc64b20453c8a9d758e78f0fc1a2
SHA15eb5bc65b4dc4e89f281dc31d7c3e9dc5d5ec4d2
SHA256ccd2b4330d587093290f9e3d26768d5f81fca996aa1eb68d170af1dc9d3cb3c8
SHA5127dca2888d173f81164dc5aa01e4b7c03f364e3dd5df4c8d71e4ecde58faf847a45428626c0d4bb9911efb21b925c52497225e52f1f4eed3db539391d94174985
-
Filesize
135KB
MD5ca799e92256895d17856b85b67ae5446
SHA1cb1cb52b8710f172e66de33f8ddbf7249a61c5a1
SHA256894c7b43d71753a4f42359671a708fd81458e938ab55f0ad221ac13ca38eb142
SHA5121b3091093e06d1a80ab004dd3d4c5020755c366cf0f1ac7604ca349d56d02404daefdfa0da795f642ee560bfd9879bef882f68a285f464a419cd1d65802a0065