Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe
Resource
win10v2004-20241007-en
General
-
Target
00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe
-
Size
62KB
-
MD5
4a0606a289c95da3733d98a64334fae0
-
SHA1
b02762728d3db7fc384a25541855b745f7449da7
-
SHA256
00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0
-
SHA512
d69924242e54114badc8ff5c24f3f806425372afad7105f36624dc9e62ce3a2cd095bc310b12abe981341380918fb8b58ecbaa3b1c51b434f11970b2db6cf30f
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyUA9sd8dF1Z1z0bvl:W7ZppApyVyjVyJ9r1Z14bvl
Malware Config
Signatures
-
Renames multiple (4538) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe"C:\Users\Admin\AppData\Local\Temp\00866d37d4dcb49583bf27fddb4973be22085e528dd24a24ab762312723544f0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5b43e72d0ed170b7e84a314423558bb90
SHA168e4c17703580135e76c77759d44239cb04d955c
SHA2564c832461f30197bf6098695e5ff90a78535e0618719c87589d73cda8329d6dc2
SHA5125663b4fc4899d65719e00e5a9f23bb12528c807466c6f7d30f3588c07f0d52c1d5cc20593a48cc1f4fc3c5f4cb994a4f01b86a987339afdb4dac98d8e6531815
-
Filesize
161KB
MD5301b47a02580d06103cc4e2d8653916c
SHA13f5c838385fb1c61b1f8f8421bef20706bebbe1f
SHA256f7c07b326a5594d131efc3e71df3c99c399a26475e387b0a0314cd50c10bdc70
SHA512030224b65598af24ac914e201ae541c915ea9875f6152807558ae753eb19d33cdb531c580b2faa5351b77312575593cd82071b3714fb23530b9e7b0f3753e64b