Analysis
-
max time kernel
120s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 02:18
Behavioral task
behavioral1
Sample
29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe
Resource
win10v2004-20241007-en
General
-
Target
29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe
-
Size
95KB
-
MD5
f4d5556dfd485483290f406b01369570
-
SHA1
df0aff4743dab58d7e1edc4c5c0fd186af656858
-
SHA256
29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040
-
SHA512
419956e1353316fd4390ab5b95bde7fcb106e3bf491707c73bb0c406da5bb7a702d0b70646d93fc4dcc112bdc15669292c45e5f635795fdbe6b39c989c4aa84b
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5mPhz:fnyiQSox5uJ
Malware Config
Signatures
-
Renames multiple (4323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/3812-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/3812-658-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exedescription ioc process File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe"C:\Users\Admin\AppData\Local\Temp\29e4e58d3e9e9ded62bc92c77247f98044c3de8e4f826a4c608da65ed3c92040N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD57dae3f81e17f6273fc23dac14948fa42
SHA1b05e13be95b8c038c61f1fa9752d1d3e1d4d73ef
SHA25643a13b3e976aa89bc3c8e2d21d44853622e96cceed834e1bcdf2f8bef08ad4f7
SHA512ce7a11a72deb3d8ac32fa5503a397d4b417314119e63ed0fbcc78e362cd506db6fbcb26b8fbd87d1a96aca38b4eb9dda6dc8aeeb62d60634612e30e01e2ffd12
-
Filesize
194KB
MD52e12e946059827dc75feaf78908f7094
SHA17fb5facfb25618651754b8812ffe5296c7475acf
SHA25685ac549d6ebfb6eeec4f85819c81de6c0dabed7a3e69ea1e95d32e7ec0e650f6
SHA51215dd3cc3f475c23184313061eeedda7c01bfb6626b224f32a24b75ac7b793af93b5eaaced95887c673e9e9359ca28613b784f0978409b26e20ffbb5ae8ce3e20