Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 04:30
Behavioral task
behavioral1
Sample
f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe
- Size 58KB
- Sample241006-e5aazssfjr
- SHA256 f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0
- MD5 b7089fa6bd57ac4c8b9ccbd7e02f6eb4
- SHA1 086207cb4e60d5de32371651d17dbfda4944ba94
- SHA512 15385edbac044b9c9873ad91125ec1ed361ebb10698024ffd0eecba98799f9db716db6578778a6b98bed7c5c4ff4810beb31ff530dd63f39470b7d328a999ad6
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rx:V7Zf/FAxTWoeQoXpQoXp
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000233dc-2.dat upx behavioral2/files/0x000400000002291b-6.dat upx behavioral2/memory/4312-976-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FREESCPT.TTF.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jdk-1.8\release.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe"C:\Users\Admin\AppData\Local\Temp\f88347963fc4cc71a3aa770e48934115d1c15d2c757827d3eda48cbccd4150c0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp
- Size 59KB
- SHA256 28c329f3f4469728944701cf88dec46df7288b3e416bdb5e71f72fbb3e3a4ef7
- MD5 e3a22c990487d14c0a1821e4d8f30d54
- SHA1 f7145582bd93abf03ec9f7fcedb31a21b77610a1
- SHA512 21ee6e69ccfa91f3a3463a74c2e25d1b5cccd2bc8470f7f70f882562877ef5d68e36f25f61b77444b452266683865e7953edb5849de5835d4a1a1f54676516e1
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2re:V7Zf/FAxTWoeQoXpQoXz6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 157KB
- SHA256 3178d1284d69978b9ea5e2f33b456430ffc0a64419c1489d2855cd65f9127c1f
- MD5 8ae9065724bb8c816161c35d70210d84
- SHA1 cb10f9f36461a0b33fe12967dd12565f7fcfdea2
- SHA512 2d2ee7411b9ee67a631815c08aa4276122f2996b6cd8455d06f6f68fd8cb1666e494f9284ac78f83e6b8b0029f95f15cef056cdc2bb86f0f64132f68c1956afa
- SSDEEP 1536:V7Zf/FAxTWoeQoXpQoX54pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+n:fnyNWHIjN3tj6qnv0b2UrXkbvLE
- MD5 SHA1 SHA512 SSDEEP