Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 18:06
Static task
static1
Behavioral task
behavioral1
Sample
f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe
Resource
win10v2004-20241007-en
General
-
Target
f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe
-
Size
70KB
-
MD5
17b435c9f613e352eef6e54e69993970
-
SHA1
b1c81156f6f8d3b3ac6f47ab09f43878b7be7036
-
SHA256
f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718
-
SHA512
5aece4c6ee53bdaf1fa1416efad056f74d0048262262e5478e943e0f04c9a874c2d09fbbe83265177f8d08b76f64cc39432b8c62cf61ea57b1d7b21a244a60af
-
SSDEEP
768:/7BlpQpARFbhvEXBwzEXBwLtAc7Fc7u595QUhUey5vhgCy5vhgJhJ:/7ZQpApHou595QUhUBgtgl
Malware Config
Signatures
-
Renames multiple (4850) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\BackupRename.vssm.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe"C:\Users\Admin\AppData\Local\Temp\f2e78f296398dfe1d93b76ae500bfc1eaf83a3604410917391be687195221718N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD51497a0a8247e95354ba9ac64923ef1be
SHA1fe5f0364672a14533d8614e4ca671f7c3bf7a51c
SHA256baa4d307585fb18502ab25108743c5b8373cb03fa79075e062ebd1189eaf3ca7
SHA512e2e4c116c871e4995165fdfbf732cd140c2ded92052cbd49bcaeefd1740019c74823af11e9b96bcf0dcca3a336ebf5ae116b339ae85c30dd980fc575b1ae3f81
-
Filesize
169KB
MD5869818c9f5b4535c8fa1577739d883da
SHA1902e06fc79f92245746b1fb22820d58df13acd2f
SHA256b9d2f0607a300799020883739e789f2561828a85516b5ca8a38c1c99c3bccf19
SHA51214ef8f6ae8cce91e340e724d4548e1b0d231bbc7ac04cd79f88f3ec66f5ff9162c6511883a8966c546176a06d5a8d69057aadd58abaf97aedd5bcb9143d2d547