Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:37
Behavioral task
behavioral1
Sample
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
Resource
win10v2004-20240802-en
General
-
Target
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
-
Size
48KB
-
MD5
4e42d19da085cf84d6b2a8f31f9e3a00
-
SHA1
290ff700ad10e8afd7f600d066faf6caee02333b
-
SHA256
d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fc
-
SHA512
d3f411e4009618fa7cfb5e0bbd0fb10934ba1d7da382930312124bc300fc2ec822b43b30c686a67cd0376deacda140f804f0607fb37ab2280f44b7246767b2d2
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJXGitPsqAJUqAJ9QN:V7Zf/FAxTWoJJXtPhQN
Malware Config
Signatures
-
Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2000-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023482-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/2000-866-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\ApproveConnect.lock.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD51791ad20e5b5ea93ed247a0931eebe04
SHA13973ee1a9553a584ca21e9a5d6c85cb33f4d2a7a
SHA256e04832ed5b8582cdb1fee34650ae81dacbefddb5a0532726c423ca5c686ae745
SHA512b5f07d7f73a52d5461a7b7269659c1ee5d78af2bbe5e1ef8904714de5cf244c526be47964425701706e6823889cb9f6a957b60a61e85b0cff1dd06411213f59b
-
Filesize
147KB
MD55c4215f2ba08b1aa3694ac9654b3e040
SHA1cc8bbcd06c7fa2c77da75c296895fc7acf4a0dda
SHA2566139f3f1e9efa238c8a88160ada8d2d69539b5cf568c7047adb178e35544f48a
SHA512a45e6e2feade9687bd168f0b3c176c516ae32beaa78999ca94d482a1e6eb2dc1143acb586a4aa5234494b42bdd959136333cc5fb1569c46a2d0559445278fe59