Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 03:41
Behavioral task
behavioral1
Sample
dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe
Resource
win10v2004-20241007-en
General
-
Target
dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe
-
Size
90KB
-
MD5
4b6a1971eda08fd89bf1ae786804aa70
-
SHA1
5cf0622b7f0b0c171e9be8d7ff87b86ea311de55
-
SHA256
dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064db
-
SHA512
8cbf51280806ec66cefdf7e690756b17ccfa2c163f617e793499438d630283949b9667229e7582b6e36bd0a9dce6f95074963c8b9d3dfa4189df963be9428a4f
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTe2X7Tuxuw:fnyiQSo7Zv7Tuxuw
Malware Config
Signatures
-
Renames multiple (5018) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/628-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/628-666-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exedescription ioc process File created C:\Program Files\7-Zip\Lang\fa.txt.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\7-Zip\License.txt.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe"C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD554a2877e98d3cf57dd6cf666632dca8f
SHA11e6e785a5314c18ff7fea65959208186fcbdaff8
SHA25636a092d3efe05074b2b24a1774edf6778e7c201c9327558b4fbe2bcd06ee2083
SHA51256bc9bd326a8088beceba961c27267cd23a600bd6c35604c57e0afc0933970733762f21c05a6328a1020eb20538cfcab90704608b0ed56224210265b9fb9258b
-
Filesize
189KB
MD54785fc14be6e3beb6506001bcb672bc8
SHA1c2f4840c28c6e2c54fb034102f7974986f722045
SHA2561755b7a9b2fe3fa05bae527701e1eeef2aaae1a170d3c0b7f2af7ec7d2a6a470
SHA5121b656195a1752500a96f6c6a61d9304bede0101b829ff969081390ed947d11620c6ff895dc728dd512c8ec7fcfffb0ee21da4e35ebd11ea44f2c6a3a8d924d1d