Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 01:52
Behavioral task
behavioral1
Sample
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
Resource
win10v2004-20241007-en
General
-
Target
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
-
Size
63KB
-
MD5
da404026ab952da41d2890c66312e430
-
SHA1
9967ed0ab0e2f97bea5994fc54b4adb11b17e28e
-
SHA256
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0c
-
SHA512
a5f9e1a6e6dd4773d7f322580590c7dd70f8846596a7d7402f4583568827f215e85d5e1dc016da14d730204e99f57ff90d6fe83efc130056901dffc1aaa6c863
-
SSDEEP
1536:V7Zf/FAxTWoJJ7T3cFMOu/h6HSKX/8KX/FdyGdyH:fny1bcH0
Malware Config
Signatures
-
Renames multiple (4311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/4972-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/4972-656-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\CompressUndo.mp2.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe"C:\Users\Admin\AppData\Local\Temp\726955cfa25a870e192d8f38feb1890328af8474a5426452e2edd7c78eface0cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD547492966ec3abcac5dadff55dd26d339
SHA14645e486a608d657ad9b1c4b196df774fcfa8503
SHA2568e985af26846fcce7e30c41712958f82cf6dc182d597027571a7a855eb0f2453
SHA512c39b846166f299a844c4f6c611a87f8dd102ec350ba8a68e5cd5970004ba524d9a00136960a22de42fadc8dd956ee4b2b3c8000004971529057dab2dd31c12e1
-
Filesize
162KB
MD586a9e99f719dd7fac506b5ffceb6a262
SHA197e3faed0f40f01f1215459fd52208e3a4d5944a
SHA256108b506102bebe225298cd24d54089d95d1dc2a8ed1aad67546445c021353f11
SHA512a0bd4d08003548161d6db872250f812183d799ee64ac027c0d03c4934554c155bebf9193fac8ce7e49d0aa36664d5a918c150b448d8b20c30b2f0a35c93204b6