Analysis
- max time kernel
120s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
20/10/2024, 19:56
Behavioral task
behavioral1
Sample
9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe
- Size 40KB
- Sample241020-ynyf2axcjb
- SHA256 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45
- MD5 f1ead52ebfe305d347c7d4272221d7d0
- SHA1 2ae56ec72ba04c5e3fed46edb186260f61e41a7b
- SHA512 6c7f4d9bf84ea91c7d197e54124fbddf0e1fd361a7e5b3afba28bf19ea8281a48ee07447e677f192f7abade04d9638ecf24b9fb218063eeb1b239d9835b9cb12
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJqW4C7C5:CTW7JJ7TPUnW42s
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4531) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/620-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b33-2.dat upx behavioral2/files/0x00040000000228fe-6.dat upx behavioral2/memory/620-659-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe"C:\Users\Admin\AppData\Local\Temp\9ec9a1c74f34854a3c00e646dad6703181ec38bb749f7766537e4cf88f27fd45N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp
- Size 40KB
- SHA256 dbec2e321b8f1a6ded03e105b2fcd2631e71394f6c1d09363366a47bcdd291d5
- MD5 a4c629ceed4003b5628add464e3d9182
- SHA1 8ee3cc3e59fafce74146cc29ff435690d9a0b244
- SHA512 6301e6af62fa5cb0e47b6df6badc01b448d8a6b5d9f2c7336358971b73414f2c83020974691307b51bfa819da6a07170c5357c386dc18c00cac55bb234cdaad4
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJqW4C7Cl:CTW7JJ7TPUnW42w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 139KB
- SHA256 8757b700d2c0695e0cf042eecf689dc8e9f52b07d5e452d856df3805189abf92
- MD5 de91e733608cd2e327f2b3d109d08aa1
- SHA1 212da7d9c7dc593490e25dc1110c0c86cd1dffce
- SHA512 780a27c06e1cacffda49da3b92525068da053081b122794b731a46e3c053157c1e64726e6fe5ee3fdb7ae38550594f95a480ceedbd600d4594b1ae95dde410bd
- SSDEEP 1536:CTW7JJ7TPUnW42U4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpY+:hzUD23WHIjN3tj6qnv0b2UrXkbvLJ
- MD5 SHA1 SHA512 SSDEEP