Analysis
- max time kernel
120s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 06:06
Behavioral task
behavioral1
Sample
de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe
- Size 80KB
- Sample241010-gt352avejp
- SHA256 de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9
- MD5 29ba6a6164b3403c8f80bd8945554730
- SHA1 63494f5a83760eb914c4f0e1098c1d27f1d64902
- SHA512 f0b96a8656c189d699f77cfe646b6e3431d7286c0c6ec14e01ac264a316fe575577d691280ffdb5d1fb2b92bb6058aa5c216ed8ad4deee44da9444d4bc2d8dfc
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti3c7Fc70f:V7Zf/FAxTWoJJ7TTQoQmo0f
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4616) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2816-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000b000000023bb0-2.dat upx behavioral2/files/0x0004000000022916-6.dat upx behavioral2/memory/2816-784-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe"C:\Users\Admin\AppData\Local\Temp\de01fde8f5a4168a99b71d22ed94d85a9ea1d37af6f8408afcf8e0ece72826b9N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp
- Size 80KB
- SHA256 7c3a5e550cfbd52fe285c9defbdf361de858007554db7179da4cf660522bf295
- MD5 5e454b83fcd3d9c783ec4ea5c40b3609
- SHA1 df5203dad808fd262a68dac600bc4298f58831fd
- SHA512 6be2392db4875e2e33d6eaacbf6dacf3e747b68f8d2ea87149a640e14f277b55940bc41505e5a0e490febc81532413dc37760304c4cdb4fd87224e6316ba7a84
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti3c7Fc708:V7Zf/FAxTWoJJ7TTQoQmo08
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 179KB
- SHA256 932167ec77dee2c002707b4a074c891b3b85456ea3cd0e154da98c1f8e44d70a
- MD5 74b5f0973974c8459a738c4629d2839a
- SHA1 1ffddd7015623d98a93425149d8b9d299f635c18
- SHA512 c38c9f230de8039f31aa5f6972e8c8eae102976d2733e414cada9823fd8233cccc1c800bc13f62d80a3324b175972f1b78435b5633f6e3a31a00e5767a164dde
- SSDEEP 1536:V7Zf/FAxTWoJJ7TTQoQmo0B4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2Udp4:fny1oRcMWHIjN3tj6qnv0b2UrXkbvLB
- MD5 SHA1 SHA512 SSDEEP