Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2024, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe
- Size 57KB
- Sample241006-sg352svbpd
- SHA256 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009
- MD5 a213f84e28226f2458a0b03c3f4d6e80
- SHA1 c234aef80d0aa808b64d1af343a187923e9410bc
- SHA512 5be3eb0223e9722eb1310f7ab206b214ece400360c5fc9d44cf0d95022208b89fa66a16a3dfc926f13254a336d144f8bfae61969a03e3cac31c96a43313486ad
- SSDEEP 1536:W7ZhA7pApM21LOA1LOl6Aj8Tu8T1Rxew2w8Aps1Apsa:6e7WpMgLOiLOAew2wH
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe"C:\Users\Admin\AppData\Local\Temp\8e2aa1114346ce95db1939e4aee6d7b0cecf1f7f1433b7c34cf8ce4e91e12009N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp
- Size 57KB
- SHA256 dc75e017c42317705ae0ec0a3aa3b9e4da314f959f46f852bd3af4fcb2a3e867
- MD5 811987fdb6cca5ac7d95c0d1c63a98a3
- SHA1 167140ab0f5205e036b9c53e73bb5e267483f016
- SHA512 e9a9a0ef0b7a28676b115c0ecc2d744c9a4d0491a497b5f5802f654b04f6b96cad98f7a475c9f85e135a49fcfd10263849d96185fc4ebef4c9d19b5fe42a3f9a
- SSDEEP 1536:W7ZhA7pApM21LOA1LOl6Aj8Tu8T1Rxew2w8Aps1Apsn:6e7WpMgLOiLOAew2wy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 156KB
- SHA256 3a646af09bca04a1c0fc713f1caff6a5885409fa88e341589237c4dffc0077f5
- MD5 ab5c3c0ec24f8824170155b4e88aea37
- SHA1 f3d4953d43444c77670ca2cd09a92c6352a7ea25
- SHA512 26eb3b669fdfa927416e0e72d8255bc5e50191c0027d668755d32079f1033104ec89aab17fe320263cccfe9919dce7dc886920c9565410e57ae032fc6fe40788
- SSDEEP 3072:6e7WpMgLOiLOAew2wfWHIjN3tj6qnv0b2UrXkbvLt:RqKgLOiLOA8IjNDv0bNXkbvLt
- MD5 SHA1 SHA512 SSDEEP