Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2024, 13:10
Behavioral task
behavioral1
Sample
5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe
- Size 66KB
- Sample241019-qeecssxeng
- SHA256 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853e
- MD5 2d4180a183d8dda6610558f3a09051e0
- SHA1 b727d16b316280f885f85406ab0704386b2a3f19
- SHA512 3f0969212aa72012dca7b52043d56379fabc5f7bfbec0eb0e4798f14fcc038570cdf8e8a26bc174791d22694828a49d854f16b0541918f895cd28be4cb739d4b
- SSDEEP 1536:V7Zf/FAxTWoJJZENTBHfiPAr+7KDr+7K1:fny1tEZr+7KDr+7K1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5006) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4956-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b6e-2.dat upx behavioral2/files/0x0008000000023c62-6.dat upx behavioral2/memory/4956-660-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe"C:\Users\Admin\AppData\Local\Temp\5be4ac5ec431eab7e0ba67baa8f5d43669a415d3e329ec06961ec69568c3853eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp
- Size 67KB
- SHA256 7c98796388f7a28ab621bd478ae3803997531dbc2aad8cd15705c654ebdf9c11
- MD5 82be6a5dae09687a004f87f4273339ea
- SHA1 e1c69c6a91fb86546b18808abc0472096abb0c3c
- SHA512 17675b2ba74a6ab07058c989313f79c61cb3034223e58ab95b7009bc50a1530c5145477271a94f07b41edd31cc9cca1c5e197ee7b52373d44bd2169ea55bc91c
- SSDEEP 1536:V7Zf/FAxTWoJJZENTBHfiPAr+7KDr+7KD:fny1tEZr+7KDr+7KD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 165KB
- SHA256 da2eb5497eadb60f86d9b3fddad3ed500b736512f47fc4e8989682d7d5a57a29
- MD5 54664821c6e82430edce29cc37a1a355
- SHA1 18e1693eb61021ed0e83151913d1a2bd745ff994
- SHA512 0274c0149b50051d637aff32df13c1f4b5bf19a551211dcf93ec17aa235e3ccc83488ec1afe73ed226faf5dd9b6bd179f47f2f6235cc6ec27674b59f3b42612b
- SSDEEP 3072:fny1tEZr+7KDr+7KjWHIjN3tj6qnv0b2UrXkbvLG:KbEZr+7KDr+7KQIjNDv0bNXkbvLG
- MD5 SHA1 SHA512 SSDEEP