Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe
- Size 64KB
- Sample241010-gddkfayenh
- SHA256 a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7
- MD5 b4d97da15c2d95fd0bff82f2066a8700
- SHA1 cd41dca5aac071c81c79a24542efa89184122037
- SHA512 ce50b6b537175d13bde5fb91c92a25d37c2b6b9213e6b65db37792eb68757c222a38a71359a1bc0f402d57b791f55d1d79604eedd0d8c171af4613ed1c3aac56
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8TmwzwkbL:6e7WpwYRYUtdtSsBckbL
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe"C:\Users\Admin\AppData\Local\Temp\a2f5b0025418be7d843056521a8a7e47cfea3a7d3a698458037da71cd2bb29e7N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp
- Size 64KB
- SHA256 0fd7166496168bc341575dbdab16e028836406ac7406fc5133e108baec474d15
- MD5 6362d2fe65d70cbb53569bd28f898881
- SHA1 bb7ab3e5e72b02559916ed24c8e66e938c9b3c92
- SHA512 c3de3abd48f43233774d12ef006fb06c0e19f182530f5d5617650a7c07d9733e4e0616cf954143f790333a57dfa7af3d4cc00e37b9078627061191811f0c5daa
- SSDEEP 1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8TmwzwkbR:6e7WpwYRYUtdtSsBckbR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 163KB
- SHA256 0cc7fb2fa1b3f60ea2f15e30a15ea2655be023dcc35563907ba80760087572ba
- MD5 890b3629f663e15a320ad50f0b11497f
- SHA1 c0f2d2726e93eca35d5098e523d8b75a5dfa76dd
- SHA512 b7f8a97093803461965e9c602fa9a42a5f423436e220a3e74f8246927711457eb1cce39aef95a88e36393155be7ec169353bdf3514393d8a6ef66795c00fa09e
- SSDEEP 3072:6e7WpwYRYUtdtSsBckbDWHIjN3tj6qnv0b2UrXkbvLW:Rq7agckbwIjNDv0bNXkbvLW
- MD5 SHA1 SHA512 SSDEEP