Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Resource
win10v2004-20240802-en
General
-
Target
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
-
Size
85KB
-
MD5
4bfa11b5f54f219e1db74c7fa05e40c0
-
SHA1
f6bef3e8c1450fa26cb4998872576d979d0da3a7
-
SHA256
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27
-
SHA512
e73c56ce7cf9016869fcf1968d0c879585d6fc67af71b0a80518852ee58f0b36244e1f7099e4a5767ef6f7b8d6b6fa6464379c6b0f8f85fbc117190a76d22243
-
SSDEEP
1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5j7R6enIQhiwnKs6nKsJCfQ4:6+WpDfmRfmhz7RjnI52UhCT
Malware Config
Signatures
-
Renames multiple (4617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\7-Zip\7z.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5b5e8993e06676586f997d3eca88a6c09
SHA14134c6e50637599129f6cb371023479eeef1b4ed
SHA25684561313c628b67e4040659374f386e23bed7ac353615a562d21ebbdf9d35def
SHA5120b28cf3da6a6c630c83f20ddabe7bbfe3c627f7faf44ccab8959343bc6fc740c021f837f1b57cba10f8055cefd956a247bc81a111aad2e7745e19dfcc620358b
-
Filesize
184KB
MD57e2b64d73142cc638e581cff7cabd56c
SHA1a155f09f44babff79e970d38d896dcb5f7d2f989
SHA256595ef336343a356664a378f4bdc40d04deca57d9afc61f67a647fe829e1bff94
SHA51228c35d6d7b9a387cfb8547a4928317cdd31f37868303a541d6a4ee58e15fe6cc8a279fa3b0f0b1acd5cecce70e5cb9cdc6ff26623099467f042ce3983c69ff1a