Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 03:46
Behavioral task
behavioral1
Sample
e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe
- Size 53KB
- Sample241010-eb3qfasdpk
- SHA256 e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cba
- MD5 b5dc8f33eef0029d8b45f87c630f48f0
- SHA1 e93f352a8dffda42aa671b684c0b81f1ad0dc3ae
- SHA512 a42e6aabf6ad4e584c1d584958889cfec3bde9f2613699a4217da9683f637bbf5d1c7e30e1afcadbea8d92ae69490608b75216daee6825b24b97b6d9f43c2fa0
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nPj6O:V7Zf/FAxTWoJJ7TB6O
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2416-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b9b-2.dat upx behavioral2/files/0x0004000000022902-6.dat upx behavioral2/memory/2416-780-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe"C:\Users\Admin\AppData\Local\Temp\e7766b280d4473b72653d0d30574920b4c61f07373bff13cca28f43e3c043cbaN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp
- Size 53KB
- SHA256 05b2a3353e334f091fe937ad041a37c3d2b3faac7de0708517dcc65512d90e31
- MD5 7639e2724e95a7ebf5fe6e77aa8ce98f
- SHA1 555873f781a976127cb900ac11d2634f2195d0e8
- SHA512 ff92936c3cef29fc0c474ab0c8d697ba835b3098002aee9077b48af188729ef8216c5ecbfca75122271c9209beddad317fc4294abd6a0c8f21c09a79834b72d3
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nPj6W:V7Zf/FAxTWoJJ7TB6W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 152KB
- SHA256 1bd19420c9d9a1f492393d054961c085a33fe271d6b08e58af86e87b2d8685bf
- MD5 705e10f5423625a56b7722fb36754df2
- SHA1 bad17566da2bd6124db84381211abb0a01d04fc7
- SHA512 9bb73b0d4d572aca2e7ac899184d1add21240dc378adf7e283ca011ac0c7bf9758ecbf5fa8523b2204860e3b7e473048568915c2fcdbdb788717c27b5dc84f90
- SSDEEP 1536:V7Zf/FAxTWoJJ7TB6L4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0N:fny1V6qWHIjN3tj6qnv0b2UrXkbvLh
- MD5 SHA1 SHA512 SSDEEP