Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 01:29
Behavioral task
behavioral1
Sample
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
Resource
win10v2004-20241007-en
General
-
Target
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
-
Size
96KB
-
MD5
7adc5ab8a091a35785d3e8f1158d42f0
-
SHA1
f4b71f89f2e26f8199f34eb0a222323e8843da24
-
SHA256
f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38
-
SHA512
b209389544d4cb32f372d2c86d61bb332c8fefdfcf8474a2ee158b0414eb8acde12ad0b1bd8bf64e13d43e6eb7f792ee19f6db4b5231a731e9736584016ee8a0
-
SSDEEP
1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtU:enaym3AIuZAIuXj
Malware Config
Signatures
-
Renames multiple (4370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3148-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023bbe-2.dat upx behavioral2/files/0x00040000000228fe-6.dat upx behavioral2/memory/3148-660-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre-1.8\README.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe"C:\Users\Admin\AppData\Local\Temp\f1e62a6ab8b591619a5ccd37413fe424fea58ef4ace810e772620f27ff0fde38N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD57b5fbfd9d972feb0b761ba641472a6a2
SHA164f6777233a054994b1453b90cc60f933975f059
SHA2560bdef094d115f3d0ae26a8a710ace986f008a51e0536fafe11c2f8acb13bb432
SHA5127c9598b0ded3f290ded85564f90701e2b32665a169ad18c94aaa02d60dcdb525e4c0d2b6cdfcfa42ce851a3961111447e5fcfa04f9e462491b5e492cc89dcd7d
-
Filesize
195KB
MD5c10003db274d40bcdce1f24253b18b92
SHA18ca561a3d43b2ae84a6accc5a0b04fbd07b675b2
SHA2567d2ba15ce8fd40f2741fa615efca8506efc32aa763e80aa9030fe297d2ebba88
SHA5128864826671c1b65d3462bc56d81b6c2e4bf15170699f71cf4876e5aa634af211d0d3b8a9fdd37e865dbab5a0bd34a635c4a04102e9b4561ba75fc6b5979eab8d