Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 18:15
Behavioral task
behavioral1
Sample
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
Resource
win10v2004-20241007-en
General
-
Target
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
-
Size
105KB
-
MD5
531e509a09b8472abd0d4cae379b2830
-
SHA1
aa61e6b86ae7079f75e45f9c856173667c06c68c
-
SHA256
826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316
-
SHA512
5b8fb2a3bf997a3b10853437231f8f810c4e3dc9620fb6c6f367b0fa962a23b4cbeb60f5476b078f0148d7e85b464d7e0ad12a66a4b334c6baf9658f8c2c4f08
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTNyoKIKMQTW7JJZENTNyoKIKMIjUv0FR:fny1tE5KIKEtE5KIK7jUv0FR
Malware Config
Signatures
-
Renames multiple (4324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1876-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b42-2.dat upx behavioral2/files/0x0004000000022902-6.dat upx behavioral2/memory/1876-664-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe"C:\Users\Admin\AppData\Local\Temp\826df9b02016feec0bc63a33fc30cd2bd4f06b0d014c3571d1d792a5c364d316N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD519729a3ad9cccbaf77a4c2379bbdd216
SHA1f5be558c963c5c7b0d849631c10c21f44bd0caea
SHA25637302cf21cdb235a0b52dec2ba9dac4b8f692c22b980f07bea6055f9006c29d0
SHA512810787a9b3736ac122572f0813af1d315c86394a9090629d4ac8f0a239b8cbda4568209a387cf1b0d4a92ea7a6b6bc9553335509fb72bb65accf3e0cdf1e0c70
-
Filesize
204KB
MD5e024a2e58163fd887a3fb8c01df38946
SHA1a75c925f6e6d0165ac1013504b6a7a641e7eca2a
SHA25669a7555178f9cb84df252a806038cfede6030bf3d2d5fc2da61e4e88ca81fbb8
SHA512d6d33614a28e4e162b7f866f05dbd9e302315cd27e99e8fb29d5a40d04b11a3abcb7efc701c1698655cdd873db56a691316a5fb35d7a3f3394d64bdb0077f0e8