Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:28
Behavioral task
behavioral1
Sample
bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe
Resource
win10v2004-20240802-en
General
-
Target
bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe
-
Size
80KB
-
MD5
564a93905326c3195f110d8443784090
-
SHA1
9efed19b407449b5b6d419ae319f2e862f241ed9
-
SHA256
bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fb
-
SHA512
58306b26cc1a27f9f510ebc64c9f47b27162d64b147884c06475ca6b781cf7b6bf1e96f8812cd53008e0c1c1cf367cfd3ca9aec3198f0dd15b96c52bc588a100
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9GR9BT37CPKKdJJ1EXBwr:V7Zf/FAxTWoJJ7TsTW7JJ7T6e
Malware Config
Signatures
-
Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4872-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023452-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/4872-858-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jre-1.8\README.txt.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Java\jdk-1.8\jmc.txt.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe"C:\Users\Admin\AppData\Local\Temp\bc5fb3fc01311426f4229586967f84475137601d0cee887ec2006f108e19e0fbN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5de9af342068dcf745d41b7ae6af442cf
SHA1e37e30ac88feba7edf80b5628b677d19d8e85191
SHA25653155faf4414767f6ca1628975065325222fa80b8b4444cdaf03ad37cd8ce246
SHA51208731c5959e2f024e470cb6525b1f89ded19087af7e0fe69386be132dbdf1b71be0a8db1f79520acd6507cf41d81751a56a13a0b4a01a5a18f44fb4047a2494f
-
Filesize
179KB
MD5fa54b6b94eb69e36754d7e41d7eeb43e
SHA14951a934cc4653c3916d74bf21a376eb57c6b103
SHA256d97920e5b96dc3120f86bbbe7c64dec7fdfbcc02f3851688935cdd77db6e6d29
SHA512b1e4341474fbf7323333cec51cf63aab3c94f80d3ee2a060752e80baa63083fdeb8374aa2f5266e51276703066e6d9ece646ccc9297235337b7e545d2a3fe961