Analysis
-
max time kernel
120s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 02:48
Behavioral task
behavioral1
Sample
b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe
Resource
win10v2004-20241007-en
General
-
Target
b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe
-
Size
154KB
-
MD5
27313bab9ce805ef77d7255ef3c4c200
-
SHA1
cdc21fed58ac974d3a2142fd2f598e31c334a9d8
-
SHA256
b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38b
-
SHA512
3bdd0b3ef6fbf1dc9ab5471a8828a40d6383d049d472666190c3a491468ad4990483dfe611bb6674d93a3597b995197971a9d3a78d1703b331e8454e73ffdd5a
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5KwUTWn1++PJHJXA/OsIZfzc3/Q88:fnyiQSox5KwEQSox5Kwh
Malware Config
Signatures
-
Renames multiple (4210) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023c6b-2.dat upx behavioral2/files/0x00040000000228f5-6.dat upx behavioral2/memory/5032-656-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe"C:\Users\Admin\AppData\Local\Temp\b5d36987d3a74a9f1af4e705048e3212e3d1d19d54c6ced1326311de298fb38bN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD5bf5e9b27cd28c91cbc9691cfb6c3a183
SHA1a188f6fee6bb40d1a6be71ec9f3cd9645f0d48ed
SHA2563b4edc1aeb5c8e2cd9fe0a8b3deaad96f6468c8d6845724c7ed32a42cc286f8a
SHA512d5fe3f234812763e72d6816d78c2239038dfc33ac594b5477dc6c13589c4f6b53113bf84c9b3b583521104dfcda3f6389334f764832770dd295752290fc600fc
-
Filesize
253KB
MD516b8fda39595ceabd9f2f35881e6be09
SHA1aedc6e0b2ca039183125c09d641a9b75986c8e29
SHA256ebef8c9ea6741b6694ccbe128b62bdb98890d2c07857592a4a109a75ba24e15a
SHA5121145b99bc97e55838bb816e11429e7787f79df8a79c954033cac295566c4699f26e27458a21916c6eb2776f2d8d08a37f4cea67f8bb6cbdd7111906f7a7f9b5d