Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 07:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe
- Size 87KB
- Sample241006-h3323azala
- SHA256 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457
- MD5 640eef5aafc8d2e26f06574433c6f530
- SHA1 889d1564440b2ca3c70eda9268db9007c0f65d5a
- SHA512 0af42310ea7f2099a3677f4e9ae2920ebc00083ea1e8a1f4c0b28de536f550a61c38d374d3378cdc2fe73632cb25f17a186a6767e988d35f44c7dd23dceccf2f
- SSDEEP 1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlDr2rZ:6e7WpRaSljRr2rZ
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe"C:\Users\Admin\AppData\Local\Temp\0f714e41d32ae96796dec9cdbf2e44da39e0f01d0a8fde8fb6b8d041aad4d457N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp
- Size 87KB
- SHA256 e474c84ca583d539e45e8f3d00ae496c40451e2b9da4db27cc703f8b43cbcf9b
- MD5 4b07e1f580176ad987bc8497e2c2ee24
- SHA1 6ec1a2667d0f6724ddaed281b7aa86e370c18e58
- SHA512 bf829670acff4a8606dc0939c2cf4b352adeb5730097f1896671a88814c3bfdf775da9f2489087e85b91547b2e10fdc90ce06e17a0d7db82b95377c2c5d02a39
- SSDEEP 1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlDr2r6:6e7WpRaSljRr2r6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 186KB
- SHA256 131a9a1ba9afd0a8c738e85f1b39f2c87b1a278b40f96b51c330e74400347f88
- MD5 a943be8bec18270030fc047c491ddd70
- SHA1 a72d86e23160b2da183e26d578c887769f88295e
- SHA512 4ae0ec87d17ea3fafd5fe7b24c1e7ed5e94f31d901ce2770785c3a5f1a9e2f98a35fa11763fd64ca550fa6fc4690335ac3dd2edde1d5a5745cc5ca829a9c6a96
- SSDEEP 3072:6e7WpRaSljRr2rFWHIjN3tj6qnv0b2UrXkbvLu:Rq/aGjR6eIjNDv0bNXkbvLu
- MD5 SHA1 SHA512 SSDEEP