Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 02:28
Behavioral task
behavioral1
Sample
4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe
Resource
win10v2004-20241007-en
General
-
Target
4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe
-
Size
28KB
-
MD5
02dd5bacd17404acfc41b55f47da1810
-
SHA1
debd84a376f67d54b74d22b1d9dfefd3aff35f98
-
SHA256
4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38
-
SHA512
2eceb0be5b6aefc227e1d2dd26de50f36da71cceaa255be8863abf959311d43cabd36be240aef01dd60e708bc9bf03d1e5d953dae1010d9d91275752a3ae9629
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Y96h3+:CTW7JJ7To
Malware Config
Signatures
-
Renames multiple (4659) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/2700-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/2700-790-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe"C:\Users\Admin\AppData\Local\Temp\4b95ebda59092a42e95e50a540ea5fefcfc6b25230ac51c04e19782527531f38N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5d75702bd7ae6628a4e195c91a8eed85b
SHA1b21d875b8c837020804e96e7572fd137689779c8
SHA256edac1eada35e49aa6e440f582cc91f21e0f02e6eaa5353e2af27f3043181ac50
SHA51253f936b99dcb95950de441f81672d87e41dfa05b39109af8dd7ef2e8de4f1cff1f3b58672bfe38498b2187991c3db2c89bef360f3d3beaba8f3b2cc6f41371c7
-
Filesize
127KB
MD5a51bc84a12706323de7f9f5879e95e68
SHA117891e4e4ebbb327283f8c6c6c082bb2591c98b7
SHA2562a87156c0714ced32d1c2be46d63d290e48958e290ab48f85204181f11754fca
SHA51248876ac6db2d98f3a0ddb6d667e45e01a45ec9968a97bbafe478ce32c04ab537a81cdd72a5ecbfbb7c2ab20429ca2404b740c9923e18329fc3d1f453e3783a9c