Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe
Resource
win10v2004-20240802-en
General
-
Target
db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe
-
Size
57KB
-
MD5
6a7147177cb45bff3d6a0d2773a9ef70
-
SHA1
c0c6e655349d8e12ee32c43698f85a52f242daf4
-
SHA256
db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006
-
SHA512
62d892886ae4dd9063f8b74ce8168e042de2eb6ace726ae40e281d8ad79b1058bef868f2126f0b60312c3117130733cb63b326b14ec1acf6483663edd4b76f70
-
SSDEEP
768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7GJXxJXp:/7ZQpApHoGJXxJXp
Malware Config
Signatures
-
Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD52a180686b88657ad7ef86fa177dda789
SHA1ea65e9a610302a1e96bb5f47c733a7cc6a33e496
SHA256415c0feb90d0d16ffcbdc14503056a18b1bf45e1072b1e739262b2436638b43d
SHA5127d5bd69b0991d98d188b41d846bbb551f889fc60a8065868c23669102ca4413d346cd2bf7adaa5a79356011d72728dd1745962c265f8ca7a76cfe214a0bd8da3
-
Filesize
156KB
MD544211e2e1318ad5eca5689a6a387f0b3
SHA1acb87a2ecb2edec47744ea3e066977cf4e45deff
SHA256b943e7ae46f310466b7938726a77303fbad5057f1fdf9d7c9f11e40a6a0f92f1
SHA5129de0152fa16c1b190253f6c7945e829b6180b526b76a25dc5c19073775255d0b3081d9a0c1ff1125d3dd28f8c974b031d49f39e94d3d1020251314c3c79bbe7e