Analysis
- max time kernel
120s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
20/10/2024, 13:24
Behavioral task
behavioral1
Sample
37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe
- Size 91KB
- Sample241020-qnslsazgla
- SHA256 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271d
- MD5 06855d6afe81c3cb9389d16f1efb7d20
- SHA1 9a6a772d0ddb2eabf9eb5bdce5e1f925991aeedc
- SHA512 1ca1823e5e412fd92b4a4c17ca881eb852b8e71983d67ba9fb29d2d490abbb630a5580aad34329f5b6752793978686108ffa6f1faf013c71fb5a83252b78c2bb
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtUMAMW:enaym3AIuZAIuXB
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4372) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2208-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023c74-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/2208-670-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe"C:\Users\Admin\AppData\Local\Temp\37fa0638e7474892d45cef0319959e13868ef32a37547b038819eaf76c5f271dN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp
- Size 92KB
- SHA256 efe05427d4ea0849494653f17661755a31ac8e407db6021d4a96eb4096076f31
- MD5 3f651a7c48faa3204d3809d98fe2930f
- SHA1 c844607624cd6bcb20e68ba547277bcdfab4c9d5
- SHA512 a909a843db2d4a78e0f17af1866f811707903e7fe64feecd1c8d84046a8e4d51b62e93253b5778b421decdefead6eb91d8738ec98aec0ef8182f62e24c5a34d3
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtUMAMg:enaym3AIuZAIuXv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 190KB
- SHA256 3dfbffc6bc6773bb8a422b599aadd0efce245c29d43521aadec5bfbe4abf7ff6
- MD5 7f718b56a896ad4062935cc4cd6c6023
- SHA1 4c003c97d0060e5c72e7346d5852a657b051379e
- SHA512 137fda231711295da347a2e58a70255e00b2f35f58a3ab522e911df87056a3ccbb587da9ef0829eda10b7404f9092e78da461bbc066102961cc2601fedf5fc7b
- SSDEEP 3072:enaym3AIuZAIuXmWHIjN3tj6qnv0b2UrXkbvLn:wHm3AIuZAIuXhIjNDv0bNXkbvLn
- MD5 SHA1 SHA512 SSDEEP