Analysis
- max time kernel
150s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
- Size 82KB
- Sample241006-e3xnhasepm
- SHA256 f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3
- MD5 b8f7014820314583359bf334344258c5
- SHA1 96050af47bd360174e5d109f49541485d70f610f
- SHA512 7755c9a5fb0aa89674b8da873eae7952a0c1374a2a4130f095ae88871c4a73547edc1c1a9707877def78e799f5d4a13c725ba9bcbda02d7fdf96b4348e69d295
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8f+EA8N1J3DCl4N1J3DClIGpyPw7lb/:W7ZhA7pApM21LOA1LOPBlv6Blvexl
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe"C:\Users\Admin\AppData\Local\Temp\f792b1eda3349a2c146a7aad382abfab3df9725bdfd49dff19eba2e2e886a2b3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp
- Size 82KB
- SHA256 ae259193976b8b69c9985fec3816a7cf669691a957767960d5df7b5710da59d6
- MD5 d0e745536dec2298f674258e1c5792d1
- SHA1 76fb13c4989eaa198d65c4f4fe2a0ee12a6f08c4
- SHA512 25ae30f7a017ad0af696618ca1d4bf0c9308d429849df50201f2d25e436ba3052fa1e22cf3714037a25b6102ef099d0a8b2415415049d7b40b8406ee4525a1d8
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8f+EA8N1J3DCl4N1J3DClIGpyPw7lbC:W7ZhA7pApM21LOA1LOPBlv6BlvexE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 181KB
- SHA256 233ebc053630c13097a78a6bd3b988b99cc20a3d22a508bb2a23fd0aef658245
- MD5 9a830f84de84c81a050705da69d1a326
- SHA1 a74337d7470666c02937a73254b6a9288658e849
- SHA512 3c8a41842a912686f9cef16c1a48baade67a60901612782b7a3a1431b9ecf068790f184d862b89eaca152bd5e10d6dafdceb9a145d294db1a2d66943063ab928
- SSDEEP 3072:6e7WpMgLOiLOJl2lcWHIjN3tj6qnv0b2UrXkbvLR:RqKgLOiLOJ0tIjNDv0bNXkbvLR
- MD5 SHA1 SHA512 SSDEEP