Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Resource
win10v2004-20240910-en
General
-
Target
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
-
Size
85KB
-
MD5
4bfa11b5f54f219e1db74c7fa05e40c0
-
SHA1
f6bef3e8c1450fa26cb4998872576d979d0da3a7
-
SHA256
670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27
-
SHA512
e73c56ce7cf9016869fcf1968d0c879585d6fc67af71b0a80518852ee58f0b36244e1f7099e4a5767ef6f7b8d6b6fa6464379c6b0f8f85fbc117190a76d22243
-
SSDEEP
1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5j7R6enIQhiwnKs6nKsJCfQ4:6+WpDfmRfmhz7RjnI52UhCT
Malware Config
Signatures
-
Renames multiple (5050) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5bb49054cd5ec1f8967c741898a08b4aa
SHA1bbd9c6aab0057c1037c7b12dcd9bbd0edd969a02
SHA2569c1e46e0753446bdafc82411e7e2eb54fd45091be16794951c667d427e5f3185
SHA5128b8539aae64a943a8eeefb30a39a3a1c53ac76e1f16b68043c071a6038409eeafea2591e8713af8db1b0cd0d1d1df701dc3399f49ac4c48da45980775bd35125
-
Filesize
184KB
MD50e86ec1601a63714c1c6184f1c1c397b
SHA11f40880bc204428913273ead88bde809e38f04b5
SHA256c57655ed626215566c7aa6f0b04c7ed339c7bf3eb33a632bc15d791588d196e0
SHA5128e05c825cb8868a1913211d2925c1ffbd57699de87c3814742241161824b7711ea96fb8d69a81372cdf91a784bb8902b527e5265f5c1501a51d72f327bab5366