Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe
Resource
win10v2004-20241007-en
General
-
Target
8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe
-
Size
65KB
-
MD5
71814d5f3ee8f902eaa026aed40e70d0
-
SHA1
1ee8f8c2c84e58eaed4be98cba015f4bc17dd926
-
SHA256
8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09
-
SHA512
c1494fda2ea17ec50f7f47ebe7070b38397e2038539e094221a4399a0fe32061b5221355eef34c44e6c7d45c20ad24f6aacba0fafbb0f648687196feba917708
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyUA9sd8dF1Z12wDwm:W7ZppApyVyjVyJ9r1Z1xUm
Malware Config
Signatures
-
Renames multiple (4544) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe"C:\Users\Admin\AppData\Local\Temp\8b36801bd5f6c1324cbc16a60aa4772e62a99855935fad3a26942324dca0bf09N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD53c95541d07fd1c51d25da8e70b797087
SHA1c60eaa6b52907b3a660ad82952932cf808b13942
SHA256daa2dcf69493638dc945f930707d639874d4940c7f2da610a9fd8615c479ff28
SHA5120902f8c7cae78df8d5a08a5547e8dbdb27d9a7c94edb86eb8ef4ccfc5a381590b04470d0d0454eb13d5144891be8d1e5b2d6cc2e6770998a2fb00aa2e0fca98d
-
Filesize
164KB
MD562fafc08d35f1ec1fa2fd342c524068b
SHA12e38a6ebc6837bdc2e9874409a68c98d779ee037
SHA256d6465cc028457a6f8f2cec828a0d8cc905c5c7f70909eaaed14c3f91db491593
SHA5129c459159eb48e0ab5584229260fef49981ce67f7b6c3cc9e833a5792e79e3a60db3ad7e8a5a2b25636e5d93dc8fc6c7bc730f888be7e94b9d2e50626001a578d