Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
Resource
win10v2004-20240802-en
General
-
Target
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
-
Size
51KB
-
MD5
30a855b03ebd5f5cd25244a79097f340
-
SHA1
95c27237b10811f373e8ffe75ce6acbe6ae830d2
-
SHA256
6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ff
-
SHA512
85edad5226d42bfb42744f143a2190d1c3c092547151b59de1397c71460c970b18d3dbad4f9d313f846e881ab8dfe1fe4b121c1aa05abb0c3826a6449cc4ff78
-
SSDEEP
768:p7BlphA7dASbSLJJBZBZaOAOIB3jM2jMO/vY6mtPc:p7ZhA7dAxJJB7LD2I2IGYpPc
Malware Config
Signatures
-
Renames multiple (4659) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe"C:\Users\Admin\AppData\Local\Temp\6fd411b520ee95049b844e6f7383ca126a763434c0f83b04b13aa507a0f897ffN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD53c52caf72d14780bd47c1831290a355a
SHA12bce63a588ee49d234c4b6a426a98f71fb18246d
SHA2560335c3e7185f6e5d5ab63126824798abb5fdcd918e233eec94322226ca97058d
SHA5126085204c0bc338e228bd7a31676936e3852c021653ef757484f423058dd9ea760f75ec1f5eab26e7b76e39165b761b6bb91d0f062ebf2d987e29c98335236a5b
-
Filesize
150KB
MD52218675cd7a9240c4ff0313e5800b367
SHA14dcef1a7fc8d9b97234364dd8c3d62df91bb6cdc
SHA2565fed103cc2a5f52c800e7bd74408484415932e834f08a0e72cec67acd43f47eb
SHA51258a0f550f79924a2b2249de6465ca668e8489d22599a14c8d87352669ff14e1d8a190ae25469135c450f872acc202bae58683d0bc1e4605e5078608e9801a047