Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
Resource
win10v2004-20240802-en
General
-
Target
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
-
Size
51KB
-
MD5
6e36613501bb2227eb33efd8f549d7f0
-
SHA1
1d27dd51cc9907047608e80653047283913bd7cf
-
SHA256
95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374
-
SHA512
90352b050a44d2db68adb4bba5fcc00294d58ee5b7d3ee716c6b9ed85ac840c12fabe9462fd3f510136a106a72cb940a0d80c26534d27f490ce00a7f934115ab
-
SSDEEP
768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c5Hjn:W7ZhA7dABJJZENTBWv361
Malware Config
Signatures
-
Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\CompareStop.kix.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe"C:\Users\Admin\AppData\Local\Temp\95d7740b6951ed61b160927d498c17486c55133aa91ea69b5b6d7a26ba042374N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5d6854dba6007459bd757cc260730c1cc
SHA16304727c602d7eaad1017e2bd0d39f7cd216996f
SHA256d98b564941b84b0222187cdaf8de7434ab8fc5d69d4536fff4791a7c17be9431
SHA512c2d61c01eb7beac540207745a606a7c15e17c2952625a7963c8d8cf45615c025659da145ea468f5430fc552fdea9a7cb3c9b7d1bb0efaaeca188fcb022a61043
-
Filesize
150KB
MD53cbb9bb175b5be1f2f263898fb7e16b6
SHA1aa2ef27eb46a7d3d7ddb75a31fb681d788e1d319
SHA2564718d12dbf9757b348b78a2ba78e65b7e740c5ac506061acdc2bd6afe510aa09
SHA512f07125b1fdec7f964c156aa012231e7e76921ee61c921098d2feaad943416ca7ab4b4e8740383e142da090dbcc272502e50bd5c3e5331b95739d6ddef9d587e0