Analysis
-
max time kernel
119s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 17:44
Behavioral task
behavioral1
Sample
4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe
Resource
win10v2004-20241007-en
General
-
Target
4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe
-
Size
86KB
-
MD5
20b272dde8e0d21f514e0d951ff6a5d0
-
SHA1
09635e063b8e9f3fb4da5983711322976cd5b60b
-
SHA256
4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034a
-
SHA512
b0368903ff1e5953bedeeada0a2ccb5440249518b38c3a5762b1659cbba19cc6d6ba606c558937221605ae1847be49b154e93c029aea1db907efe3f2083fda1a
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5Kwi:fnyiQSox5Kwi
Malware Config
Signatures
-
Renames multiple (4323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/712-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b7e-2.dat upx behavioral2/files/0x0014000000022905-6.dat upx behavioral2/memory/712-696-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe File created C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe"C:\Users\Admin\AppData\Local\Temp\4f63ad5c50a5b99c97a661109f13ab424f55b693478a151e02d0009b4c61034aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5700397ac0d5b86998eb2897da7d64a86
SHA15a800106cd452becb7a675e6e25a1e724cda83ca
SHA256e643cb70724a3517660fc2b3a5cd3f6424fbae07d72b93be5dbae076f99f5e91
SHA512b5d7074911911f16f0eb27f0a53daacb6ed9de86b7ada6b07322f625e25703cbe0945b9f1096095cbf95a03c072d2e21aa0dbd0303f486acc208df350c56fbd4
-
Filesize
185KB
MD5525981ec0f25228a6a29f4c60febfff4
SHA10cdbf984eafcdb28e9cae7b184235ff72654d16b
SHA256e05071b8e54c70c57b7f9bf44b6931677bdd1d68307642c12b1d5153f079484e
SHA512be1c78b89c8863afd032d36222d865cdb769b091e589b3229f25f193bc63976b1464ea7009cdd0ae73102201a0ca75d088590c28f715681f3c212cd66f77e2b7