Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/10/2024, 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe
- Size 56KB
- Sample241009-266rxa1blh
- SHA256 bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265
- MD5 cb80943bd1667604f159d3dda4018ad0
- SHA1 c4ba55469897cf807467e9fca1c47580d425df5f
- SHA512 287002f657d05af75f6cb94299e126639f8724db806590261c60aa08142aa99fb4146374cf712b60b2cb369ccb0463ed19138a5d77756e2344c3e4b325092cea
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V73:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7L
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe"C:\Users\Admin\AppData\Local\Temp\bd753b519d77dbe84301e13bb03b885d3311cdc682036891e4e40bcd8c294265N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp
- Size 57KB
- SHA256 edd0ba56351b86779db387bd1b1a60c7f507518298c5f4e6a8af3242412a4916
- MD5 62f99fa16d7eba1ddd664f6a0e4e303b
- SHA1 4757371a21e48ed7ea1cb5e1f02b99543cd9ce1f
- SHA512 588d50c2b2f049cb32b673db40e9c9d590000efdf1967525605b8289975774de0a40b11357f41ed144676a270caedb7867614cb03e23ad35a43177ac500ab9eb
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V74:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 155KB
- SHA256 e7634e29b26ce7037580197d00f95d1427ba45beb112461f3a7ba4f114d7f4c5
- MD5 7644ba80438dd44d037db8e51a1d3c33
- SHA1 8e6503127ea30d89dac888c36c4f9ba593f8e9c6
- SHA512 a90f7aa59b3bc6fd8b05f345a61861aa61f73e2ce7ab406e28ed2a3fff71da1f99bf0715e97dc9b082a5a2d5df27108e8de4998ef398991b43f9486305206f33
- SSDEEP 1536:/7ZQpApHo94pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddb:9QWpRWHIjN3tj6qnv0b2UrXkbvLd
- MD5 SHA1 SHA512 SSDEEP