Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
Resource
win10v2004-20240802-en
General
-
Target
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
-
Size
45KB
-
MD5
b1c3a5e077547f6d533888d59f487e10
-
SHA1
c6501eb4454933b1172d742a2d19e05765f6d21e
-
SHA256
0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2e
-
SHA512
d1a6bf331bd9855694f6212d7c9e9b12595296d5823a8d0493422a91f5bb8b7833d79a3ab2b89d0864ceb5f7b1c901b1e8c1a0f19bf8dae79cc1c50dea8f0f32
-
SSDEEP
768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaC:W7Z+pAp2nKLRKIKqoLSarSaC
Malware Config
Signatures
-
Renames multiple (4665) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe"C:\Users\Admin\AppData\Local\Temp\0ac69a7d86d56d179f199f0b340fdeb4df7d5d4cba251dcea97a8ade114e8e2eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD596c739801cd9ad224b51fa0137c69350
SHA1f9808ac23bcda5d3b466010a5c91bfb8d619a4a0
SHA2568efcf69d87f9e8998267985ddb47653db8b397d0d5938cb3c69be05b36829695
SHA5125f7caf84a628fb8002a566d9020e2802af759f841536909af707be833c299ec9033c90777a03298b39e7fac20a7a135d4c7a278528ccb083ac693963aab8854d
-
Filesize
144KB
MD5e604ea9c86b19df3987a7d5ad0215f60
SHA11752ec836d15886cf6b98f857a7f3dfa4a4e2729
SHA2564605a8931e4c255560d136d2815b0bc548cf81a598ac9a90545e8c7e9ad85cf0
SHA5127ae0c305cd09e930667c360e2d00353749c77f476d347442d9fc835fcdd2347b2d01133663db6bc3e06d55d2cb13a2fc8bc6a89265d83c93e5769cb8d6009de2