Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe
Resource
win10v2004-20240802-en
General
-
Target
f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe
-
Size
69KB
-
MD5
b79c395149c6b7c2a28806a450b36080
-
SHA1
cb2cefa66dec5ae9c64bb1991e3d566425b213af
-
SHA256
f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36c
-
SHA512
7376a7ad22032bdb04290c34e279d7f5edd8db23928d0f4af406192a5611a81ae2d2e680ea81650500c3e6f167e688bfbb4ad6eb74f404811f23f1ef33839216
-
SSDEEP
1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxrLX6v:6pWpBwchcV2WxrLG
Malware Config
Signatures
-
Renames multiple (4616) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe"C:\Users\Admin\AppData\Local\Temp\f014907d62071c467ad49b8f4a12755b60d6f57f45c1a567e39fe2988d31b36cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:81⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD582a7c9eec11a49a60a904419b64b5a92
SHA1d3cf79113727b8c51656c0a731781f2f4e52b708
SHA25636c34c647e9413c01547319d9f2f85ad105984c890107ba0ae717ad5146e1111
SHA5121a4c55464142103d11d3bf5df32f4d2297ff52ea253fd573842348156be36676a3ec1b21e98be39f872f40317326925acac9881ab46014b3f12202920e371436
-
Filesize
182KB
MD58fc63f3d3d790a5baa3b144baf58acb9
SHA13aa2eaf289f60a40ccd1866b2ebf48a717b3db59
SHA2567e321f783856edaba2d3bd490b8f3c256d539cea3f33bfe16219801b6e5d12aa
SHA512b0cb0c2b9ecc4ee54d96726a4800af080bee992b88b23639130dac2f394c3dbe0476200dd3f0be46d98ca42b8743cf4024ccea6e87dd5728497e01c7a14a9bb7