Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe
- Size 58KB
- Sample241006-ac3dva1fng
- SHA256 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef
- MD5 2bc306f3fa96d1c8d69e79626e6a820d
- SHA1 fcbf9aaa24ceb86d26f4373c024262a93ffb65b6
- SHA512 668a81803e7166e7d5f87225a4efb11f65bb506ba15476781b3935f3898b22ff1e75440a095f6dc0e4bca6f7fd7353dd829e8f06f2e7970085eb6fbf12ba80f6
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0Iap3gyaHq9nwK8gvgyaHq9nV:/7BlpQpARFbhNIiJwsJwwnZap9QKQO
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5041) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jre-1.8\release.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe"C:\Users\Admin\AppData\Local\Temp\938e4ea528a662989582f545e404b24601a3f4b0ae14812e55cefd8f02acbcef.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp
- Size 58KB
- SHA256 04cd2c1d36195edc4c51f80733304ae20d6d31fa106d6e2b0ee10806a72b607a
- MD5 1f59c8c4166c03e5b344fe60a074132c
- SHA1 ebe23aa160f6377c814b1c91a4c5cb1852ef796f
- SHA512 6e0b7f3257856fb0c8295b5bad1562e1d406210491a439cb1834c6b1a74af1554aed5d1046bacbb13e36be7008f89c08385988b7082b5501903459994dabd474
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0Iap3gyaHq9nwK8gvgyaHq9nt:/7BlpQpARFbhNIiJwsJwwnZap9QKQS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 157KB
- SHA256 45e8fefc72db0d8268c295a5af1b518371c2efc88e358af5b3be6316c779fd62
- MD5 9b37a016c1ce4d64bebcc4b4f0ebd656
- SHA1 f8e2b36d0cbcc8b5850d23223a3e7b95c46214a6
- SHA512 dad9713c68fe349615e4d8be668400fe7bb8668531390d89e7278102b205ce6200c49774e1924f95c3171e799e0bcabccb6509909dc087b4ef630c7e8dac7484
- SSDEEP 1536:/7ZQpAplJwsJwwnEp9QKQd4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpX0:9QWpjnZfwWHIjN3tj6qnv0b2UrXkbvLJ
- MD5 SHA1 SHA512 SSDEEP