Analysis
- max time kernel
119s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2024, 12:51
Behavioral task
behavioral1
Sample
e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe
- Size 33KB
- Sample241019-p3qv3ayeqr
- SHA256 e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326
- MD5 9efc4de525b49ebb712c635f967bbe50
- SHA1 593ba94f0ba11a011cf78e33a7d4294a608fdb78
- SHA512 2daed9fc8e975307cf10aab752699e0312f446214119adb9b3cde3a6d82017b7a274878cfa2359055edff1ac3b756fbb77c455ff3eb71562ab67deed562a9bc8
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3Pu:CTW7JJZENTBHfiPu
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3052-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b33-2.dat upx behavioral2/files/0x00040000000228fe-6.dat upx behavioral2/memory/3052-781-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe"C:\Users\Admin\AppData\Local\Temp\e04502e2a90a08a74552c76e7d5537c64622861c88b0858fa352c53b6e519326N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp
- Size 33KB
- SHA256 3db2f97d739f83c994db5e632e7ad671aa7f9dfa4731c79892afda3eb6812d23
- MD5 44796cde55eaa4860fe464ba5a20c716
- SHA1 da87c068076dfc67887334d34c03a114657bacdd
- SHA512 f067dc26820ad1f6f488b9953df24a6ea55eb446fb0649527c792289b02ec5ec42ecd4b142e94329dfb71bf1b5cec8bb4f9436e54095d3efd51a9cbfb0cea499
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3Ph:CTW7JJZENTBHfiPh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 132KB
- SHA256 ce49b9669232d07646ee78e484a83dea29ca8fbd99f11ccd944bf95f13870154
- MD5 fdb1e4e9bc0a8c839cf9da7170baf604
- SHA1 553a56a1e7f31203f922ab8f42e1e1bbcf5c82cf
- SHA512 abc5a9a24fed8583b6dfe09a4c276930c2c3fe6575ec9f8fa32d329255112727f98c04987c9ebaefed53eea6893c54932bd3625193a21fca5eb620bc022d8cda
- SSDEEP 1536:CTW7JJZENTBHfiPO4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpW:htEoWHIjN3tj6qnv0b2UrXkbvLi
- MD5 SHA1 SHA512 SSDEEP