Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 17:43
Static task
static1
Behavioral task
behavioral1
Sample
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
Resource
win10v2004-20241007-en
General
-
Target
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
-
Size
59KB
-
MD5
d3bcb5cf6d217b72d3c849354e69c810
-
SHA1
7b57c43fdc03c155b1f156f8b73f64762b45b713
-
SHA256
22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6
-
SHA512
cabaac3f75ae11c4da9308e5fc10e5b5bfd6b78fbddc1280bf6984555bd4b5b492eeb1df097bbce5b89f4ca801cca788a771f662859fa32cfb607874f13d9b81
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJw1VyjVy/3sY1YxwDwk595E:W7ZppApyVyjVy7Uk595E
Malware Config
Signatures
-
Renames multiple (5032) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe"C:\Users\Admin\AppData\Local\Temp\22c89c2b23316eec08f33e9e4f03ba2767a3366ffece4653f16a7dee0dbfb2a6N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5bd2671e08620db37b3c2a9947e24e763
SHA103d07d096cf836f8156dd1417d1489f458b9ea8d
SHA256046a94f07bff1dcfeeea7c8872595b6a959b216061f8684c58604a88ac7ab524
SHA512094a3ceef4b7d616bd4bffd0e8094a1c6b19a7f1d82967c13d34145bc56af2e2e840beb7518ad024189132e1e82ac3ffc28db94af7cc08c71c9a586dcec1df6e
-
Filesize
158KB
MD5f23e14c4e5eb090745c93e50274a4280
SHA162a47ac18d3405ce5f62cd0555c789b9d7630dab
SHA256e3aa1641ec0c8ecff29c55c11e15f034c28e32eca32a34304959c1e694555832
SHA5125b61c5843e1e3234c6fec75411e86934a27c7c146b4c5faf62441007426443036f7a73291861a83c7c2f2db741b11a4aa16e9b9297718bd0f0339baf8349e431