Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/10/2024, 22:27
Behavioral task
behavioral1
Sample
9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe
- Size 52KB
- Sample241008-2dlk9stcml
- SHA256 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508
- MD5 646112f9943195253bcee297ee0c0ce0
- SHA1 5f3538067a794bb09f6ebf77af4402fbee3f24c7
- SHA512 be22da5b982ffd7006c30af1ba42dda685eca32ab07375d3efc143e9c11e2fb3107117d8586cb39fbf64a94e0f682aa8d922833167d4267e7c41c9a5a8fd033d
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEf:V7Zf/FAxTWoJJ7TUE
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b4f-2.dat upx behavioral2/files/0x001400000002292e-6.dat upx behavioral2/memory/2316-662-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\InitializeLimit.001.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe"C:\Users\Admin\AppData\Local\Temp\9d5f7ca649c2302090bb8e4a6dd7168ed5f9803425a4bcdb7db3b37afeadf508N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp
- Size 52KB
- SHA256 6c7c118b98b941b74195dfc4190d471fc5ca7c05f51c4964fff7c521a6e3a6b1
- MD5 6bda7599608e6a8ec0ae74eed9572463
- SHA1 6bc89fdf56436757b70ab1bd92bd9e1cd71bfb6e
- SHA512 c1a2eb29bb725f45f75ad975927ed0b4d6534af628c3688b36c1e8067831fcfdd56f66786d0736698563c64f591b46bbd7939e7d1c264637f395ada0a7ae5c6d
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eE0:V7Zf/FAxTWoJJ7TUH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 151KB
- SHA256 6c7c301f28840c4f356b967cc4c441b0f49672dac35779786aaff139ff3eba26
- MD5 bd3e67a42d8e06d9e149035c0d5550e2
- SHA1 aab9b986a7874f4ac31c38cf9a4d172e343a6df1
- SHA512 5c6866d7d51b8d17b1d9e91e9ae51459e235f1156b44560ea714c00bb62686e02fba8394eceb5d3079bebba8838ffb35a6411e0d4037df9e424b6545560c6fab
- SSDEEP 1536:V7Zf/FAxTWoJJ7TUl4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0R3:fny1ooWHIjN3tj6qnv0b2UrXkbvLR
- MD5 SHA1 SHA512 SSDEEP