Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 02:49
Behavioral task
behavioral1
Sample
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
Resource
win10v2004-20241007-en
General
-
Target
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
-
Size
61KB
-
MD5
74ffee820845401576717cd1d4e5b2d0
-
SHA1
b4f2f674e11a6cc065f62bf3dd6e18716af551aa
-
SHA256
b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735
-
SHA512
bcf842fe48c29061779a3cd58a6a21200a6fbdc0436245bcdf8378a4bd35b0b05c42f09c8899734bc5f0be9a2ef9fdf247549fecd43642287fc32f001c8a0439
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEUI0n0uI0n09sg:V7Zf/FAxTWoJJ7TU3n0Wn09sg
Malware Config
Signatures
-
Renames multiple (4380) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1316-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000d000000023c1f-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/1316-728-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\7-Zip\7z.exe.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe"C:\Users\Admin\AppData\Local\Temp\b848a0f6bccb12ca632cb96012ed0c4d1b0730d6c9bd33d29a0ffc2ddd549735N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5d94ae92ff80139dade914ec3082d9b6a
SHA15b6680b3c0272dc8e46b96235ef0340330de0b50
SHA2569455a7cb3611d3ebfc8a6918bd0bdcb70129dd8ea4b94c03ccfab9de1b3813eb
SHA512383fa6016049bbafbfd8b2a575ecdccf92dfc80c9749f4c9e8230a1395f592bc7dfc11dcbba75ea74c7b73499bab9d1234576297ae7a0c8a26b964a9a9a6d329
-
Filesize
160KB
MD54ed26ee0cb70f7f793e4a36d448c19d9
SHA17681b5134a165c53ca49f5145bd9d7de1c29ee7e
SHA2569cd412dbbbb0e34af846a0f82c84cfbd58426157af8a3900a028bb947277ed3d
SHA512f68f7a3c36a41093d1c20b3fdf5efdaa2643c7de4fc6e19c612528559d027441103761ab26126e0f9ed999dd787f63783ce2126efaebd623bec54aa24022f86c