Analysis
- max time kernel
120s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe
- Size 38KB
- Sample241006-glegpsybla
- SHA256 a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6
- MD5 fbd301c1537127c3449ee2fd14b44940
- SHA1 5ce78d5b7dd89109f01ccc8c6f428143e65cced9
- SHA512 1cae558f219c58646c31abd04fcde645ee090779651deab8f9528ec146bfd3e791d2857bf7f72b00c1cc6aa391eb56a061c98e331c3961d203730aa41e08b84f
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltz:W7ZhA7pApM21LOA1LOl6Az
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe"C:\Users\Admin\AppData\Local\Temp\a508c26ae7c6835eb8ba0f98afa0c5bd5ddfe9ec6b3f46b1b9371c48380e8ff6N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp
- Size 38KB
- SHA256 9c777ef348eae9d6c5c17e3b7105720a0f79b172919c54a6d9e610b866eda992
- MD5 42c0b58ac1235e540d8e7c62fe000b13
- SHA1 f9753ba16245c6901c517d26f4d73e241d1a44da
- SHA512 3912a7fac5716b28845cf4a1856e81b035438c5e14e2122d06517937a3cc19de3a102d8ddf1d90d0efc1408b5389f519110fcd04ba372eec3fd359ff94d7496f
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltL:W7ZhA7pApM21LOA1LOl6AL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 137KB
- SHA256 7091789a2a0e0081ea2deba7bdd8feef9d3d60746476be722227af78bc41bf24
- MD5 6f8728771b18abfbccc6348a2e14f264
- SHA1 f095a2d1c87dc0258c0080da9a943dbba53ef867
- SHA512 447cf8989171b64d2403884fd3f021bb978ab94f675cfd5ff577bed2a8ca54e6fdd8e5df507ca79db9ad3c9b142e01ed93edd262d1864267fb5422529ed619be
- SSDEEP 3072:6e7WpMgLOiLOkWHIjN3tj6qnv0b2UrXkbvLp:RqKgLOiLOHIjNDv0bNXkbvLp
- MD5 SHA1 SHA512 SSDEEP