Analysis
- max time kernel
150s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2024, 17:49
Behavioral task
behavioral1
Sample
00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe
- Size 59KB
- Sample241019-wd2dtsyfrb
- SHA256 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3
- MD5 183c826bb40b7be65fcef1781f85c400
- SHA1 a0a984d71bd471d645059fd26e53a4334cd47d3f
- SHA512 8e4d8a1b93462be46f358f64dec2da3c63d51d04eadd6275f5b249330145da2af433a7c7a46c165fe77ed203d94861b38d4a72d56052d0651ffeded33ed9860b
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3Ps8/8V:V7Zf/FAxTWoJJZENTBHfiPy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2128-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b6d-2.dat upx behavioral2/files/0x00040000000228fe-6.dat upx behavioral2/memory/2128-650-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe"C:\Users\Admin\AppData\Local\Temp\00a621855151373613d235f68c42c0c616c150df9e37b2b654483e9f698359c3N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp
- Size 59KB
- SHA256 fa22c95ea344d081d9cfed8f6d67882992e2bdac13b310763226b420096f3b8a
- MD5 0cf4f0407109353e069e4e0028197d63
- SHA1 95e87f135e4aa220056595fcd490511507ea497d
- SHA512 fd7d7a7986526af59ca5646536a442f6386f28fd20630ffaee5cf2851cbdebd24c84cf963f4890125876cc30219cdcda6e94d2718d72d3cdea244fba9cd1139f
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3Ps8/8k:V7Zf/FAxTWoJJZENTBHfiPT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 158KB
- SHA256 831f072afecf822b195578834acef5db3604bd28334bbebbd6b73b6ad3c2ebc0
- MD5 7be8eede96fb0353a72152154c1281ad
- SHA1 6de5a561cdffa15ad91369d07f8033c1315e4618
- SHA512 08d3981efd1f19d938643a2e5b61f8b874a8abd1ad16826619d2e50f5298a8bbdbd9b87552d7af435e940dfea30196c163bddd4b0337e4e3387163a60d98bede
- SSDEEP 1536:V7Zf/FAxTWoJJZENTBHfiPS4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2Udpc:fny1tEoWHIjN3tj6qnv0b2UrXkbvLx
- MD5 SHA1 SHA512 SSDEEP