Analysis
- max time kernel
120s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2024, 16:14
Behavioral task
behavioral1
Sample
2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe
- Size 95KB
- Sample241019-tpp4tsvdqa
- SHA256 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349
- MD5 194c1cac12b3481d43a06afe2d2c86d0
- SHA1 1dc3a63d47568b78eb5a59fe77f9132621de0e0c
- SHA512 34f8eae9381bdb45c6f8c7c9005472678e6a15fc10804fdc2c76c2f198e454d1f514fac95ec7aa4beb9bd34049ff3d38eb3bb0fe450cf36c247349ba6993e6dc
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtvM/:enaym3AIuZAIuXF
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4263) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4044-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b85-2.dat upx behavioral2/files/0x0014000000022905-6.dat upx behavioral2/memory/4044-654-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe"C:\Users\Admin\AppData\Local\Temp\2c979ce2f3896fe32759d5b7f8aae2e9121e1c63083eeb188bc6f3402b342349N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp
- Size 95KB
- SHA256 2f1a98196a9d95ff0908ee540d729417a8bf21dd4f2ebb9dd747783dbee156ab
- MD5 4aec0c49592982fed587f325876a3617
- SHA1 cc13f52a625b5d3730b6da34b2250e3b8e9405c2
- SHA512 a1e2d8ad7c365202c8c833a881d96d3b6d4f2bc25cadfd64c5e0f6debc923560aaf7c7032689013dad433c5d51a3a972a4ab0081c4111dc4bcb81867f36d32fb
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtvMb:enaym3AIuZAIuXh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 194KB
- SHA256 b56bc1eda3466dd092b9abca66a5b4fe6b040092ccdd9e06b483e42e51c2a2fb
- MD5 9ff89dfb5e0e8a4f301c6655476c33ec
- SHA1 cbf66ab6bb41a3dcc4d10f53eff7b22467d8df59
- SHA512 40944436ea3db5314a127b1cc8cc98b119ded3fb69df0a9dab56c2c7f07715668049488c8c3a8167782489d4114e956be6812f7a19d5341575b95e0cd50352c4
- SSDEEP 3072:enaym3AIuZAIuXXWHIjN3tj6qnv0b2UrXkbvLx:wHm3AIuZAIuXsIjNDv0bNXkbvLx
- MD5 SHA1 SHA512 SSDEEP