Analysis
-
max time kernel
120s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 17:48
Behavioral task
behavioral1
Sample
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
Resource
win10v2004-20241007-en
General
-
Target
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
-
Size
64KB
-
MD5
55fc25084bf403088db8eca691b6bc90
-
SHA1
e7e832a5441358fa01b68c8ea12571952a4284a6
-
SHA256
c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3
-
SHA512
cd9b98bf18f40917c4446075acc09b32b0f9207af9f2cc4283ffd8f494152f90facd234b4e41b975cd0b0efa02eeedcdeea8a8e6f3c3c520ade8ac83ca6da72c
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiPSqNEzlp:V7Zf/FAxTWoJJ7TTQoQ6qNfQfF
Malware Config
Signatures
-
Renames multiple (4629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3592-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000b000000023b8f-2.dat upx behavioral2/files/0x000600000001e5c2-6.dat upx behavioral2/memory/3592-782-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe"C:\Users\Admin\AppData\Local\Temp\c1754baa83057ce78e2363d8876b2c936f3946a38a52b26ffc2134f45a7dbda3N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5e6825d5b3476fb2a84c0fff847fe148c
SHA1a59a79f55238bc7d2131049dafe2b1b0aa2eaf47
SHA2562ed8b17a4bf8cc6979b102db4a8891f0b53e3bb11ccd3bfcc1862877eb200513
SHA5124f4cbcbaa07155a6a65a0c8a9416193bcbde6a65d4fda30fcc822d2ee3ac26e399f039b0d17a518ad9b053b62ea9d7fce217e966c60fd622a46960752d34bba6
-
Filesize
163KB
MD560e7b73d353745ed8400e1136943a74e
SHA17ae6e7e4b78438d2a739801bc930eb04febd7e25
SHA256af089235d181597768b1330aba4dabd2b9c79efdd5c77429f301dda08d77b2dc
SHA512202c854b9113d7e27cd90f2a7f47c75453475ea456d7b6a5ddaa5ad2cfa605e8292f08c62d12200e298b6660c3d7ab06be2e6250126149bc1ea31052fffbc567