Analysis
- max time kernel
150s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe
- Size 68KB
- Sample241006-m871esvfld
- SHA256 ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9
- MD5 7db1f44a1367070a7ffdae3dfd9e17f0
- SHA1 d9e9cef0073643d8327b1274a8db4681fae63b2c
- SHA512 0d7e6d69e463a9e601428a810e23f6fdc0bae9c50d7fbe8979a441bb6112d74d6e2e154194e76c729e37561e9d533fd0a313d7631f1ba5896f9e37aa8252859f
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzw3wxEhLfyBtPf50FWkFpPDze/qFsxEQ:6e7WpwYRYUtdtSsBc3wxEhLfyBtPf50M
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe"C:\Users\Admin\AppData\Local\Temp\ad65b01515889e0ccabfffb8ae3944764ff0a20b6245abbd00aa1b587440ccd9N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp
- Size 68KB
- SHA256 a28dc18b28c9c991ddcf1e0d8c935c844f04751e90a7739e594a06c7031804b8
- MD5 3f8e6bad5a4e6e1f2bcc565a80f8b23a
- SHA1 8130d779ced4b0bedc86a0955ab5b6948ec91b16
- SHA512 5dc9db1678c1cf3f71cdffdcca0306a5ebd70f1142c17e678eb8453339cd519f8849edcfc18781e18fe5bd0832381a912c7a1475d126281f37c24b641ed5243c
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Tmwzw3wxEhLfyBtPf50FWkFpPDze/qFsxEt:6e7WpwYRYUtdtSsBc3wxEhLfyBtPf505
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 cd80d389636df6c10b864743168d9f145241ee306286d1ea1026f23cc7325c44
- MD5 8c5d892409d29b56ff1eb00325cabe2d
- SHA1 d4663d47da3079db651a83a2e312bdb40f7e6b4d
- SHA512 1ebabe7c59f7026b833f6485e839c9f5438c5310357081ad7987628f4dd7e8d7a589887e0d014850797384e4e12e1b68a7401beae3976a94508f3d931eba427f
- SSDEEP 3072:6e7WpwYRYUtdtSsBc3wxEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDY:Rq7agcdIjNDv0bNXkbvLT
- MD5 SHA1 SHA512 SSDEEP