Analysis
- max time kernel
119s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
16/10/2024, 03:58
Behavioral task
behavioral1
Sample
e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe
- Size 61KB
- Sample241016-ejx5xswamm
- SHA256 e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865
- MD5 7f24edd76b2b27d42a6271c64f5ae340
- SHA1 39c2b65c03bc0b63bbe4970921b1f559bd1ec387
- SHA512 5bd4da7fb0636619f1a2127e6c6ff34cc59c8df6d1a0612e82a4085318be34cae228f0fd5802524d1fcf4202e070f4730234be38048bd11b53821590e07b2783
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iB:V7Zf/FAxTWoJJ7TTQoQ/IV
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4856-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000500000002309e-2.dat upx behavioral2/files/0x0014000000022905-6.dat upx behavioral2/memory/4856-666-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ja.pak.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\ConvertToUninstall.DVR-MS.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe"C:\Users\Admin\AppData\Local\Temp\e8fd8f2cc58473bc2feff9da7a3089475b1042c16142b4d0ca01bf89101c8865N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.tmp
- Size 61KB
- SHA256 43e3aa56fc293b8d9aada047ad12add2941f33226aa62c1b918b2c94ac01f2b4
- MD5 69e2af3d8af5c573d57d8135d9ed48ca
- SHA1 249476d87e1f8d6a8bde7608ed2dae7d4c3ec423
- SHA512 26d9cff801c12b9fe9300779e3f417b9408434810cbb3266913fbfc42989a244886069a83df7a5cf5fa303c2fcbf3fa39c60479e7acb6251076b583eb3249f98
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iE:V7Zf/FAxTWoJJ7TTQoQ/IQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 160KB
- SHA256 8a1354aab3e8ff046108a5362ef0d529b20f4587f860e1f331c13942e0c10d8d
- MD5 6ab15d685cba6565a49cdaa3f81e5131
- SHA1 26106ca9071a3e8ac7da586425c63b36fae64470
- SHA512 361f0f67bbcb1ea2d0e70e3cb891bf7b7de55e652d93f71bc38592e72ffd9983ba3dd00a791bb587f3f43dff4c7f2317bc7eb617c7d79150ecb343e71b051ada
- SSDEEP 1536:V7Zf/FAxTWoJJ7TTQoQ/Ir4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXE:fny1oR/IKWHIjN3tj6qnv0b2UrXkbvLR
- MD5 SHA1 SHA512 SSDEEP