Analysis
- max time kernel
150s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
- Size 37KB
- Sample241010-e8h3astakq
- SHA256 bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aa
- MD5 77085df35cf21d33f6b86cd14e8ee8c0
- SHA1 0509fcc6d317f8347f21cb442be83f2a253708ca
- SHA512 727a9d83fdfb07bdcf2a2e67657ba6ff5fb0565599ce179eeaa3798c00ef4be279c881fe20f8424881838b85ff97e0d4e6270c64c9bc88a8f59d8f42b545d956
- SSDEEP 384:yBs7Br5xjL8AgA71FbhvsDYcUYch4AqAJOK4AqAJOG:/7BlpQpARFbhsYcUYcdqAJPqAJX
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MISTRAL.TTF.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNB.TTF.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe"C:\Users\Admin\AppData\Local\Temp\bca6ba0d22a951940636dcefc4877e3f0a11f6b76993062a2b743ff057dc02aaN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp
- Size 37KB
- SHA256 a3a538de35478a01a735da2e4dfb464ae82683a218fc2a5b94be580246367c74
- MD5 f18858cf8650d2c9ec3b0922a11ff814
- SHA1 2e5690ff37c21b63ca52ecba7ba33e03466e8973
- SHA512 9cbba2ce6b2364ac0f124aaf27463d749b3a4de7a0ec7df51aa52e5b21f4f60c7627b6d97f5dc9b1cd20734af9dc12c69ec8c6c3788150adb9de3c138a753138
- SSDEEP 384:yBs7Br5xjL8AgA71FbhvsDYcUYch4AqAJOK4AqAJO/:/7BlpQpARFbhsYcUYcdqAJPqAJ6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 136KB
- SHA256 9c644c063b0f972332b0dbccc2b271868225cfa8d75139682177b7229d16042b
- MD5 67241aa67c52dd81e2fa52ba0754d7c5
- SHA1 8d3b89f1b1272a112e5d0287b085bdacdd8efcb3
- SHA512 2c9398582eaa5f8b3e24ca48198f7d5941541b32e89a43df3a2bb2c7d97d355350bb93a0a828a77b08fbd48eeebc0833feb971718fccfe3ed90611a4d01491e3
- SSDEEP 1536:/7ZQpApsYcUYcR4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYfZ:9QWpUWHIjN3tj6qnv0b2UrXkbvLO
- MD5 SHA1 SHA512 SSDEEP