Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe
- Size 77KB
- Sample241010-bbef3asgjg
- SHA256 b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f
- MD5 32b550fe214478e38e59fd723dd4c361
- SHA1 608ef7377c630733bfdec87cbb2d5ba20cc6419d
- SHA512 63969925dc46f05cd91efe291a23e6012c7da0ca963483c353affb9d04b34758cb16f378761a35ad35f824aa1d5391cb0b13b1f8b5d4f261cb428f560e4ec4e3
- SSDEEP 1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWu3:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWu3
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4874) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe"C:\Users\Admin\AppData\Local\Temp\b9262122ca02253a41df023be75e3a7acc33b6eae119a4292e2bf5b4af98396f.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.tmp
- Size 77KB
- SHA256 5c8472390e61ce93ca5b0e396a3c2f1719cbb12810d1b0414853e329aa36e7e7
- MD5 39407cb86790ebb2edc43bfbd74b8900
- SHA1 7ecb915c776585412cab1697463b5aef4ed76fa0
- SHA512 52c36a57ccd6ae83a273f55a5055381f87871f7552932576ddacb8aca0ed533bd470b78728036de3743e48f5c09f5b071206a644dc17b858f8b41229d2f2a24d
- SSDEEP 1536:/7ZQpApze+eJfFpsJOfFpsJ5DVSWu0SWu8:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWu8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 176KB
- SHA256 8b3ab607133c4185d3c868c9b4bc67859b22be02fe7646745b26921213c3878e
- MD5 b6ec69624a5fc466103b07e56ed95ad1
- SHA1 a6eb8c583daeb93a8a56ef1e9b6ffd3ce40379de
- SHA512 4e8a1470672dffb0570192892d95d377abfe84508a8dd2eeff0f71af424e12c8981f8dccc31e13461c7f2201c7dedef76e079233084e5910403aabe389ca1497
- SSDEEP 3072:9QWpze+eJfFpsJOfFpsJ5DVSWu0SWutWHIjN3tj6qnv0b2UrXkbvLa:Lpe+ewDVSWu0SWuqIjNDv0bNXkbvLa
- MD5 SHA1 SHA512 SSDEEP