Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2024, 08:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe
- Size 52KB
- Sample241010-ktap9ssdng
- SHA256 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5f
- MD5 fbdf2abbf933e76c9d5f32d297bd52d0
- SHA1 04137a41e12e4e6672856c2c715975e8bed5993f
- SHA512 548e4a2cb896318ac2109a3e3a235ae90b27f4e17739c16b9bfb7e4694842c81b4858eb44aef129606cf9e21ee5a389ec98895914f68a482b2e752dbfc621017
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V7D:/7BlpQpARFbhvEXBwzEXBwLttrA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe"C:\Users\Admin\AppData\Local\Temp\06938737891576514c46faab9f465f9910a2eba92e5d375b25134b5238a96f5fN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp
- Size 52KB
- SHA256 8d9a656eca149f998e220acd9edf9130cea2e02fe243b127d5932f0f6f33c307
- MD5 38fefc70da40390df4d8c1149ac8cf33
- SHA1 d82311d386561edd984e0a39c3a610d297544313
- SHA512 36efd7c3046af9b1528ed213f528a012b5bd48b6a397cd7027fdc646c71deaf4a7295882b48a7e189d24b6a8652acf2eb7a495c96e38f2fe83e8bf61d46249c0
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V7+:/7BlpQpARFbhvEXBwzEXBwLttrp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 151KB
- SHA256 b8420561217238121c1a8f27fe60b0a65bf8424b874db809cf7d5945f94a5d4e
- MD5 0d229fd8981a7ac6e0b9bc7a3a38246f
- SHA1 47d0cbb403b983dbaece9bbce42df4e96487206e
- SHA512 805082bea16462292241317cdabeeecbe2a486798c2cc00ebe46b388cd90047f32c7b1609e2d45e1979cb4adc7117cd25feb340a0f502d6ac05edd81d7ca5fa5
- SSDEEP 1536:/7ZQpApjrM4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddn:9QWpvWHIjN3tj6qnv0b2UrXkbvLp
- MD5 SHA1 SHA512 SSDEEP