Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe
Resource
win10v2004-20240802-en
General
-
Target
d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe
-
Size
87KB
-
MD5
bfd1da1beda3e01c878da565462285a0
-
SHA1
c3761151b1f64d5008e7a3a2bfd231fb897d0965
-
SHA256
d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683
-
SHA512
dbfd9a2b220b2275beb359195e732523676ff5b688a812b42db117f39df9f8eaaf56835309c4b8c838cef83c3ff97b9aaea004fc6cf5e137482d85590c7b8d76
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhu:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsz
Malware Config
Signatures
-
Renames multiple (4548) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe"C:\Users\Admin\AppData\Local\Temp\d457ecd961565056f89ec4fa065b67b1cdcb046ea3caff7ce476844b5dc04683N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD54186f8108f3178c797dfc607bb09356e
SHA1af2add8d4cc6be00b438a27d103837f58f0c9a94
SHA2564046728ed66d09fc3d88fa678d9e98768f265a08ab4bd04955b3e41ff1604ea4
SHA512d68e14cb7d7bc1fdfd7329aaa2ad15226fd7b73c19235d4027fb24e19f7a9d54c59eaa7bcdceef6dc5708e5a29685c79f51f82648a271f55c829b8d108cb0b90
-
Filesize
186KB
MD50d85e4f4bafee95ce9d31a74fadcaa22
SHA1c05f8ff6f65cdfef6449c9229f704c01c0fc5bef
SHA2568fb0b51967d6bb637bcc57682b213e42b98774df3305d91b83f00f0d8b51acb2
SHA512fc9a1a56a67b995da932d3d9c67f27cda85f461aae28c12abf83b798722933c7943c735ac7fc5833bf4631ac481be5a762c4822ed609fc9ca7d73041c2f26b28