Analysis
- max time kernel
119s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe
- Size 39KB
- Sample241010-ddxfrsward
- SHA256 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344
- MD5 569963ef9a5d87a0a657a4da01636240
- SHA1 cb69f1e222d8f8940ff1911a4733b31a3eda0bc0
- SHA512 2d4e2fc3ce6f7257fae3660881b085780916db9222d7c76399b7d6c2c65c679bd02c5aa2be8a26dce4fb544a4c7b9f1170956a60cc536788dfdc7449194c3f96
- SSDEEP 384:GBt7Br5xjL7lAgA71Fbhvt3avjZjTc7QUlac7QUlwn:W7Blp9pARFbhSj/n
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe"C:\Users\Admin\AppData\Local\Temp\01ac69be83eed8ad9d11527ebc93540e5d0ff4b034d20887a1f58b9fe9213344N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp
- Size 40KB
- SHA256 db3825ba72b40d696c0f704f24c0cfb2ab807b9cedd4012797728d62699de5b6
- MD5 e24c52b98ef9551364c1fca345931e1e
- SHA1 968616431fc3b03261dda3c4bc0f7ae154417158
- SHA512 5d12b93cbc64681798168a4e96785ef30aaed57d9abb5e726675d6ff5259fdcaf1d64c0a6fbdf19a79f8e5b74c402daa6b41d52428939eb0f35e63f65cd74a0b
- SSDEEP 384:GBt7Br5xjL7lAgA71Fbhvt3avjZjTc7QUlac7QUlwl:W7Blp9pARFbhSj/l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 138KB
- SHA256 dc4de9379712a9d94c23796e47ce131b321fd2ed7c74850b099900398d3ca735
- MD5 37e9d79c50fcd552654d4d095f2cbc60
- SHA1 fd3a405945515da661bdefe9158cec223f20bdc6
- SHA512 09b333849aef8988a034353319bf134589ce4f5b7473c459d7693212670568a46df581da602d6fdfebd2ddb781325c87790cdd22881d82b877450b8a21725fc6
- SSDEEP 1536:W7Z9pApJ4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddv:69WpkWHIjN3tj6qnv0b2UrXkbvLh
- MD5 SHA1 SHA512 SSDEEP