Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 03:58
Behavioral task
behavioral1
Sample
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
Resource
win10v2004-20241007-en
General
-
Target
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
-
Size
59KB
-
MD5
fb6b7e82fedb8c4296e87659acb24860
-
SHA1
f73f041a381233a6800c3c38c15245b6d3ca065b
-
SHA256
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333
-
SHA512
b53fdb7c66a9e9e6e4458c51152448aa5cb459866f1831b365a57bf6a2221b53e8e7e93ae21bf0c84320597c60e55506fa288d4708170724d2efff1999249808
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iY:V7Zf/FAxTWoJJ7TTQoQ/IE
Malware Config
Signatures
-
Renames multiple (4623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/3680-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/3680-782-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe"C:\Users\Admin\AppData\Local\Temp\42d5489ba717c1f3aeeb7c9d343adabbeee5b0b4283679705dedd48cf3d22333N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD522e2002c189db21eba2abec5c2bae1b2
SHA1c543fb468955808c6ad84f070b666cde4439c7a7
SHA256bb6daca08b90f8ab1bdc4d853396d5c771b6ba5d385647d195af81add08047ba
SHA512b71245252ccc526631a3a249ed54d4821f975c804e3c1f1c7daa329617b643b47499a316c55a7f7b0dd6c204c16389bf43db55429f589c3d86bd1bebd16d1f03
-
Filesize
158KB
MD50293c1fbff4ce48d773f170b9c1e4056
SHA167e68e5f855a9009e88c39a20a4e12097dedcfb5
SHA256ba66eae5381edbaa7da5aafb9dbdeefd30e56b77fbff801142fb617dc1156a12
SHA5129bf18e95e160f7e531e5c00a2024de3d559cfedaf49b450c0484efd734ea70f9cf63124f0d338399e60ff5f5db77340773424afa5b87b6839125d6bbd6a326f6