Analysis
- max time kernel
119s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe
- Size 47KB
- Sample241006-nzbrasscmp
- SHA256 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ec
- MD5 058132f392e07599a60084ca02e67650
- SHA1 40048bdf1796050cd55be623aebc7bc01334ea83
- SHA512 af61bb953dcf9df060b0f2e30b606f0fb243825938fb013aee31cd690ae7a1fcbbce7ba25bfca5ca2e13d296c99e42c383c86a62fc1867f81a2d5f7c83585d6c
- SSDEEP 768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaC9G9k:W7Z+pAp2nKLRKIKqoLSarSaM
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4680) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\AppXManifest.xml.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\ApproveStep.scf.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe"C:\Users\Admin\AppData\Local\Temp\7542709fb5e8b32bc1e69a05db97db96be31a15d3d8947ff2ec4bf3c586f11ecN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp
- Size 48KB
- SHA256 d8c36fc55eea224e1ad40a3b3d0bb50a1f6f0eda8b6057f27ce8333fec99303e
- MD5 30b828c14cfa2a09009c939628e76f21
- SHA1 9742c6618f21dcd9514f6d8051c7052ff1f2272e
- SHA512 470bb2eb783dd23dc3e97ecdbe36a7e6a2b1f7d5a6340af3e177771d9deadef306030e309532fc00523831459d1caeef121ce76c572ace3ac112f7f67c179504
- SSDEEP 768:W7Blp+pARFbhBgnKLMWK9WKD2N2LSarSaC9G9y:W7Z+pAp2nKLRKIKqoLSarSaK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 146KB
- SHA256 3e8d8328b25d90c6397ebfc85266eae0ad48579459df5357a38aca67f740ad9c
- MD5 d8527f796d32f8c1885714e867ac1283
- SHA1 ba7aa9452920cccc6aeafbd80e4e4cace873f592
- SHA512 598233084a1d42e2eb3db21399aea9cf8e5799ed379a1351f11ca1617effbcc5b550139087bd5785345cc1e3133b06d633a66667bc57e940a33cf20fa8d5cab2
- SSDEEP 3072:6+Wp2naKIKNSarSaRWHIjN3tj6qnv0b2UrXkbvLh:AonzSarSaGIjNDv0bNXkbvLh
- MD5 SHA1 SHA512 SSDEEP