Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 18:05
Behavioral task
behavioral1
Sample
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
Resource
win10v2004-20241007-en
General
-
Target
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
-
Size
584KB
-
MD5
e7be3031468930b44c6679487d4e97f0
-
SHA1
0098d8ea27246df367ee815407ddad7279206a6a
-
SHA256
0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9e
-
SHA512
8a3e0cba2570bb9bcffc0c5f46494d0ea7419c5a9b050d91d72bb520bf8aa0d237a9a48620506746b4abed6dba8fda525f4f0b251891278fee87047b6440fcc1
-
SSDEEP
1536:CTWciVRRNRROHrNOPLeMS+YanjU8YKLGPavsH5d6mFUejEdH1v6H1wH1I03pkTWd:hRrRgxOeORYX3FFodVv6VwVIu8X5y
Malware Config
Signatures
-
Renames multiple (2187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4144-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b14-2.dat upx behavioral2/files/0x0014000000022905-6.dat upx behavioral2/memory/4144-429-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\7z.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe"C:\Users\Admin\AppData\Local\Temp\0514180baa874f8b3b502baef8aaef8b473dd696231991f03b4ce55db9c4af9eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584KB
MD57c15f6650fdcd1d159c97a27d0f3c4e9
SHA15d1a0464f92e78ffa31c8298acdbeaf0bbebd160
SHA256faa576d6562eebc739b5d742d7b9beaf387d8d1c56b8c0188f3d0aef8df37bcc
SHA512cd7bd0260deab5a7366b9d4a82080af52ef585100d3d4a2da7a597ada8ec896a4898a3ab972e6c5f20b5586943da586075d0ff6b9c741b0103d4852127eddf22
-
Filesize
683KB
MD59cbe8ada79bec375447111997b5889d6
SHA17ec10507d0152e4849fc70856c075138a9704270
SHA25625e0d55573fec916e6be5fbbfd5826142726cdcceba2e8b304b2880d5526d797
SHA512058dbcfafbe2738dbffc82c6b6d32ce61ab7148711111993663260120951f8e7cd943b4c44b7fc134ada6dd9690dd3810bcc6e6a4fa57cf86ef0d15133364bea