Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 00:39
Behavioral task
behavioral1
Sample
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
Resource
win10v2004-20241007-en
General
-
Target
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
-
Size
43KB
-
MD5
782ad2e90988c8eebd513cacd783ad40
-
SHA1
bc6ead544f4650ea6cd0c988d3a668d053d90acf
-
SHA256
1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbce
-
SHA512
ab132af80d7ecd94c511a1c8fd914d8f42ed5d1c61a748d6bea2f244c7d34c777ec5aad85cb9d053b0603fb17f0f01c6e2585df99e9445121f4cbc4a4a5a797d
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBZ:V7Zf/FAxTWoJJZENTBZ
Malware Config
Signatures
-
Renames multiple (4631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/980-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000b000000023ba6-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/980-774-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\7-Zip\readme.txt.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\BackupFormat.dotx.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe"C:\Users\Admin\AppData\Local\Temp\1d76b24eeea34127a776a91c4e27ea78e3e327ec1a1b89012577320233f2fbceN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD590bf0638eac15b11b53656e3d31e260f
SHA1773af47cf49b02aea3a640ff9ceec9bc6cedcd4a
SHA2569e87db4dd24eea0b536c490de34d055fd5598591a71f512e77b2f5ee9524a24e
SHA51248d6fa3587754a7a77b517e25c6e8a6cf1829ec3d51e61c4a288c0fae86129683a0bdabcc5679390ef5e5219b1a6334090f8eae5a50f1b5b7b7acf6360f35436
-
Filesize
142KB
MD5a77f3e54fb23da299c7825b8c441e5ef
SHA19b637418d0ade10f611c6fc48f975e84d36f4039
SHA256c57a3e2c5b0c95153ab81be4b89ca7798cbc479619348dc2020d271b6d144aef
SHA5123b8de63cd45cbf82df3650371223db0e1dc2c2bf78656f4c8631869b7140be6b5809853813b25f46e5dcfc21f65be27cd60cca589aad2aa618cd837676bdd0a8