Analysis
- max time kernel
150s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe
- Size 82KB
- Sample241010-k3l5naserd
- SHA256 c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2
- MD5 601f31c144493ea3e21b0e117a1caf30
- SHA1 b672c477c7865c9c1b7d272fca7d83504e099cda
- SHA512 e46c0b2bf6cb020c65f4c55dd7a6e43336b8295a331fbc3db32f8227b570f80f959fe7e447ed1a6e559212bdc902eaecb9ae9cab2c0d0b1eadabac7f447155c3
- SSDEEP 1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlecR:6e7WpRaSljYcR
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\uz.txt.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe"C:\Users\Admin\AppData\Local\Temp\c1330f594187882dfaa6a150bc4dbe0a6ef724be890140c0a119129059ee7fd2N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp
- Size 83KB
- SHA256 b80dfe1c99b428f4a937d3ed629a1879312922806cb3a1685e2c95ff87e2e8b3
- MD5 2a6e2d2758b84d07ba549307c9f0d7e4
- SHA1 ce0e4ceccb3aae74be92c84b758cb2cf9367da08
- SHA512 dd61fae695462379df11674b1ed8c0aad96b85f1c8d574b9b99fb4c5027d16b019dfde8a2e3ca8f5dcb8ffcd9a548b9a183370c3d83b0df1eef74c68a77c0a54
- SSDEEP 1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlece:6e7WpRaSljYce
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 181KB
- SHA256 1506dec1188eb456b37e669619e39ed726d11a9b0c2c8bc8cb3c32258e16f2bb
- MD5 2d1afcca9ed2bb84d9dc59eb164c0bdc
- SHA1 e963cb866437e741ab0c4f4ac23a5cc1f529df33
- SHA512 f008c4c33310a39a6ee9dafb69a3ad45472f841c427527483a2df35ce46d5dfcac0c793e02f239b3b0638b8ef3fed38498de9e47d6b43cedc0d58f699cbf475b
- SSDEEP 3072:6e7WpRaSljYcJWHIjN3tj6qnv0b2UrXkbvLK:Rq/aGjYc+IjNDv0bNXkbvLK
- MD5 SHA1 SHA512 SSDEEP