Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 02:03
Behavioral task
behavioral1
Sample
44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe
Resource
win10v2004-20241007-en
General
-
Target
44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe
-
Size
74KB
-
MD5
0b8d97f20f6c88b444c230f508c78960
-
SHA1
5023c9a6e8ced323a4f0bca30809b5c21a466aca
-
SHA256
44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01c
-
SHA512
8ae237a3b34481f2bc97288ba0c3e2442066e3f5c81ecb53807e2caec5d944cb818575a8adff238d86e38f1d9ab95d002d8bcbda86faf4dadb53e1b2a80c456a
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJu+Zl:V7Zf/FAxTWoJJ7T4MKTW7JJ7T4MC7z
Malware Config
Signatures
-
Renames multiple (4859) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/5020-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/5020-708-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exedescription ioc process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\7-Zip\7z.exe.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe"C:\Users\Admin\AppData\Local\Temp\44aa979d70c28e001b71f0073cc3a12c90800b8ef1fc94b1a105b484bcf9d01cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD50807762764e7924cd8562e35926a706d
SHA11211f010544a8dce9463a47b5809499068aed6b6
SHA25636a3432303aeb48ef3c3949a32b8839deafdab30aec5bc671ddd2f22a3cb33ce
SHA512a3fd1c2b02f8f95c6aa8aa9cb2f9a17b13c21c08afcdddecbd4440df0a78972b73555d0dd417502480a7de72919e0c9bc816eaa23cc40add90c3464f84bf6f8c
-
Filesize
173KB
MD5b3b7f0629f5be14690cba563439bb032
SHA1465edfd2c268a8fc6bdac9a691b51664b8e5e674
SHA256247ef961e8e9eeadaee16f67256f7c6d5151b331825149bced564ebf27155667
SHA512bff9ac57fec28f2d00194e18961acef5ea0944fca0d8acb0d859534a22d21ce14f32a6236213c1fee901c2e29d0b24fa9a0a37ac21a355109c1394ef4d9a3bd8