Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 21:57

General

  • Target

    452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d.exe

  • Size

    7.8MB

  • MD5

    7b7d04d2c0bd8ac1f4923b0655baae6c

  • SHA1

    e731959a1dde67ad20a3b86774d7592ed7241d49

  • SHA256

    452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d

  • SHA512

    a91eb78116db32e2cc23195545adc4976ee4b2f2e3361949a661396bb1a8b7b2f9060f3f29f43cd4256e8b763ab61a6f21781a8778bed9c8903c575435b13e39

  • SSDEEP

    49152:9AMtSgRWpAIRrRLzZiNo7IcyO82MzufjWJA6ongaHLvKLA8VgbKW2llxobcJOu2r:jTOrRn+os45gaHrhdw3D7nTsReRR9e

Malware Config

Signatures

  • Renames multiple (317) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d.exe
    "C:\Users\Admin\AppData\Local\Temp\452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\SysWOW64\sysx32.exe
      C:\Windows\system32\sysx32.exe /scan
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4240
    • C:\Users\Admin\AppData\Local\Temp\_452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d.exe
      C:\Users\Admin\AppData\Local\Temp\_452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Windows\SysWOW64\sysx32.exe
        C:\Windows\system32\sysx32.exe /scan
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        PID:4912

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          7.8MB

          MD5

          1283656c9ad7f7fc5e05c54687949bcd

          SHA1

          ce250f06c74b29e7eb8863204288d03afd7e129c

          SHA256

          cc632a348ba6e5ea417dcbee2f752909d15877439db4330667e4c1865f4fd26b

          SHA512

          e3c63f2f0d806bc9eb61bd5b24c26aee43a686e6145620a74fa963d39531933bad405e2d3f55f6df13c14992c75c0522e7a3ed859b554ee2954c4a7d9093a0e6

        • C:\Program Files\7-Zip\7zFM.exe

          Filesize

          7.8MB

          MD5

          d9ce6a5ab06f1017638883e55d1b6bc9

          SHA1

          4d087f964e28f09739745e2b88a0992ea2174a31

          SHA256

          18d401cb0b57f3cc95f8081fe4addc72c0be65772d6fc83aaf3352dd4d242ce7

          SHA512

          af56eb8bec5dda8b33351dca35c2d39e6b55a9505a2e28abfdac983d9ccf235cf742e1f3b800ea4736495ffdebccce053db13bd5ac56644b4b69359dd307731a

        • C:\Program Files\7-Zip\7zG.exe

          Filesize

          7.8MB

          MD5

          002f3720fd3fdc9768ac4f8334df45bc

          SHA1

          e9598cd68ba66b6fb8d5bc8e2afc19f068dd50bd

          SHA256

          18a2a2a26acdc22567877093ed57b83b298dacca509c812870217051d98fad20

          SHA512

          5e6e88b820b441bb4c380bd290b140c9c3f999b8a1fe85ba651981dce4f7d579d538ffd97643336dc0da86633f5d99703f5d44540ba2cac5e8b303818ea8c0fb

        • C:\Program Files\7-Zip\Uninstall.exe

          Filesize

          7.8MB

          MD5

          e85bf8e93a36929d8b11f7a9236fe19a

          SHA1

          b5ad2f1ad06a7f7beb0300e46b81a6270688ed25

          SHA256

          2868893b6dc27dabab363789c43d4606a2cd15af4f93541ae1d6c6990e5313b9

          SHA512

          3f39db32b39daa7e723ead3da796bf5495417fc9d016449242af43bfa046af31a7f6480b5d7e26e0f7211580cb4bc887cf59421ff8a1e21f829e2b3ceb90004a

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

          Filesize

          7.8MB

          MD5

          88c9e1b124a28b07a9dcc8ee526bbd89

          SHA1

          2df0c44c2a9f06a06d44a9e4ea4e017d8c691397

          SHA256

          082b927f2ec41947d5471ea85bddced2d97b6544f72730aedc9fc7fbb0c75842

          SHA512

          3e5e5b7605945a58b81b0cf1d826c089c9e4574da2f200897564b902823991e603734796c355cdd99ab9353dbcd8f40bb170377fe5cc12da45230823e99cb9e3

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe

          Filesize

          7.8MB

          MD5

          c26c71382375c4bfee7a07b97342bcb0

          SHA1

          af12b23ba804bc49d9cd43cf007f1b96dc1af571

          SHA256

          c467b776e19a35e8b271fb025c510d585c51c30d0fd8ff5f869d586a61fe32b5

          SHA512

          a516f6307692b63045bf7d853e87035f53bb32074fd4b921680eea0355550d36a2198e76df6fccfdca33a31fd91bbf6158a2e5ff6a16ebb0b6b826f491080440

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

          Filesize

          7.8MB

          MD5

          52e54e9108ea720fcd87b0e7b6157590

          SHA1

          0dbb5586d0237aba89f4818cecbf174a0878a6b7

          SHA256

          39f118fa992083aaa4c4a8d1274a332745853826074af7ff3376174b110ffe32

          SHA512

          f93aa7f545b2cf58f31be1a207f3437645d8ae1d81a2537456c9d30edc58fd08b06d8e6b7e1c777336568c81d44077471549cf7e56a64e4b5846227da20e75f6

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

          Filesize

          7.8MB

          MD5

          b49efa65c097ca7a6bfd2c8cd36d6ac5

          SHA1

          0ae93b44d008aa4917d570b22110e7cef3eb05a0

          SHA256

          e7b66279e52d96e9536f4d25af590b7310bfcc05d97f9ea4b9c80dcbe9f58e94

          SHA512

          4f6f702a72a60869d6ba98d848c9168e9c2d2c1aea570fca2f69b7f2e9a31da4ee868a07898c0000935c2b26baef748b936cb636c78d5ad616426f19cab17cf3

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

          Filesize

          23.5MB

          MD5

          4a164f1c54e83dcbd2ea887be2606a05

          SHA1

          2b0b0e905bbb47d7f99b48bc9e15c4e116c834ad

          SHA256

          3e9075c12acb9a870212f62eb39b49f4bcd157353f6579e40afc27f54c0097d4

          SHA512

          add263526835637de6315b3664ceddb74c5087e4f50094933d8aa87fd0defae1df1cb7772b6444f97e82c284973220fa72d0e7f2ae4a377d60076449fc9c1d1f

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp

          Filesize

          10.6MB

          MD5

          339fd0b215eee9d3c92dd1b84f848d18

          SHA1

          a7bcfe63ada3d39e81953d87ebb3834a80ead18a

          SHA256

          c6441f9ffde183f759de7bbb7b7470ea9eaac1843ddf57953eb2151dd209d732

          SHA512

          cfe505a8044c0394af9b95edae7f1a851b1970eca5da596ae8f702aab937a5f21e5c8a00cb6be2d81259aea1641094c4c76867b0f651b4a6d69119e29470c5b3

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

          Filesize

          7.8MB

          MD5

          136c62dd6d02fe0dedbbadac010c9474

          SHA1

          0e36e9132092aabbc12b5252124172ed2d8b2362

          SHA256

          8855a7ab53caf0660cc7ae2cb99a196946a743575145529d6b98410cba9e4ad3

          SHA512

          d8d662cf6f498c7c495b7d3d7e81916fe959bc57247539942845da2c881ed4a4725241779ca0b91b0e58a5482e2a3c61e40eb5c9bb48c8c9d434b6a8250a9799

        • C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp

          Filesize

          7.8MB

          MD5

          0a8b559bcee551b10a22311f4bf4c599

          SHA1

          69f986cb2a99ecbaabc3d28d78a2e4c40b681dc3

          SHA256

          3d9bfb081e97e3fb62539835e7b3082dac4d706f0bb727586b950194b013cde7

          SHA512

          b34d86f8ccd83aa13a543997b38395817bbadb3c1acb91755f8681af59022d2ee6b4da32f984a2ba2426ce1c4e19851c15ab915b44f830c9f30644ed92ce70c3

        • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

          Filesize

          7.8MB

          MD5

          ad7201af23f40feb4b13a9d957297388

          SHA1

          845bbfe77922864211d39827ca2532bd78a6b179

          SHA256

          eee0805240ac4d2a8e0d380fa9602c5bb0372e356d9e4900269b5dcd439b05a6

          SHA512

          c351b161f31aae00462a78156a9ead1e2d639ee4f3116fbdae4cb36c97b9eba8b48423485504b91827369d96a6ec879b68f048d2dfee8f00b7b309ddf109182d

        • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

          Filesize

          7.8MB

          MD5

          3f66287db1ecb997f6ae6eb00e3799d1

          SHA1

          2090b1a2c00ba97fcf8647a17c5a93e80ba576ed

          SHA256

          81c3ad7ea8ff1d421d0c712d6c39f926742c7baa8e9baf1b0a6360eced2b6445

          SHA512

          d4e56715600a2f368c2d651ecc4c50ac23fc598955d8cbb2e48fae2f59bc302d5a524e367b55306662340fc33c611166b9e0095d246be076d3b2b2580bdf713d

        • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

          Filesize

          7.8MB

          MD5

          4178bfecf05579e133a820f0871b30a6

          SHA1

          823f7a71bf90f46235d66c0cd9a18bdf886bc7a5

          SHA256

          c8a578de8e36061b67935cbdade6dbf7cc45bd87ec619396e982d47cb9f8f3fa

          SHA512

          7a0067128ecb6fab0ee89bfee92f6ce86e02e29d8ef6e12d7a8cd6b822b83952dcc1f15386b8e8a4bb4626e2048fc4d315fd467ea3923a21e3c38b71996bb864

        • C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp

          Filesize

          7.8MB

          MD5

          d333f2a914b23c2a6eed27a695f51482

          SHA1

          1c38ff2009f4946b226a0fe4aa4b0a0d4c2ea700

          SHA256

          e78d4aeefbc8b8edac6bdb1bd282592400f3c6bd50403f375f68040daa85ba91

          SHA512

          81e530b1902b9908f3e55e2dfdd895172911cc152220adb157434b180a27a3dbe516df89ab7b70923ccacfbe22ec2784b5bb843f92b14d0b7fd819d9252bb735

        • C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp

          Filesize

          7.8MB

          MD5

          49eb90d38e5382385cb897a3c341bd0c

          SHA1

          cc005739ab56431c2d77cbbccbc0b0391fa4b086

          SHA256

          77c4d80a885721f0a4ab4e4edf6368ef5d3b5345b3100f4fd5ffa4180a92fd3f

          SHA512

          7b5305219bcab3dbbe771b7d64a21e5185539e810adb74d0273bb8921df4e861e3e27e014120ee4230cdc0a0a7a7962e04957a8ff0014fc03d7cdb1353699229

        • C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp

          Filesize

          7.8MB

          MD5

          e47e48aa717f984ca22491abca524e73

          SHA1

          8da3d3684cb01a8d8f41424bc0abfd7fffb29f60

          SHA256

          bad8f7f83ee3c963974f5cee9c373cb7392b8e25a234192c37e9d8c4598ba787

          SHA512

          123a11d0d7deb26656f2cd3606e6ee3a4538c80071126159d9b417d8622f7b7b244e0df0c8b92f35b9265f6c4a359b352f8a2299c756f03c7ebce81bb3745fe5

        • C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp

          Filesize

          7.8MB

          MD5

          7066cbca007ea260a7300e31d770bff2

          SHA1

          6be68d3c1c6471cf68c5e4d553d03e0311bd21f9

          SHA256

          af3eb2cb513724dc653c0ecfce77bf9813e9f958becc06f0343e9b924c3a86f6

          SHA512

          5312917a6a090430328b6bc6ee0c6f0d39bf523377d1b65a44c26521158d09b42166ffd6018172849ed4918dcf0fabfce7c593d1eddcbdeefcc90c32e40d2cc2

        • C:\Program Files\dotnet\dotnet.exe

          Filesize

          7.8MB

          MD5

          f6851e0958f937a72dbcfb5ccfbbe7af

          SHA1

          c548c2af452a0cb36054843ecb8d1db1d72a6b8c

          SHA256

          a76d554f30e83da33b2db3d5bea3af449e5633a7c23cbc7b2fe2704e38ecde2f

          SHA512

          e73d33e2759715541fd873b894f0ee96231a5fc684234c2a9bf42dd5a483e3acfaa2e71cc773de580882d214bcc286e61fbbbb219d8eb45f1434b659db9e092d

        • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe

          Filesize

          7.8MB

          MD5

          6f236fca580f38e3be2e62bcc372ccbe

          SHA1

          38c3d7f236ba8d2ce8d5c57e1d75db454418ddb1

          SHA256

          3d82998d744c868463c8778f16a71698bfe68b4626bebdde26507942851d9543

          SHA512

          0585fdf31e6f99f1914538fab6d79becf9b90d629348b550497aaaf1a219928953eaafb584d0f338ae87c640052a0177b55067c0baa641d89b349e8406cf142d

        • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp

          Filesize

          7.8MB

          MD5

          6bf929213a7c5e0593c2eea66f529039

          SHA1

          e4baa6e57ec12d29ed4c8abe86f6f5fbe2575f5f

          SHA256

          cba0d5811503a62d1e6e80559aae2961d77d360b9251863818b6ef0993274ac4

          SHA512

          47b7ac26a514a477ba1f4d7b7fd4a7bee4ed58741b870c55c655381b953fa71c4507e73c2f267ae296364eb7834fcfc8662f982d1162d1bcd97f33cc4875a2b3

        • C:\Users\Admin\AppData\Local\Temp\_452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d.exe

          Filesize

          7.8MB

          MD5

          7c710979c9aa73050d5aceee902d52ba

          SHA1

          4b194e0bddede5b3f8f5f2c15c4f3964b61d8189

          SHA256

          4619008405e01c106be3f8f145bd21cf449401b901ee1ba01d1541af45f675ab

          SHA512

          0e8657ad437e9042119829da3bd3e1cf604ddba10619847700f3cd5cde91637280a356a0c559b047a7a38e2984fb7aafb7cb794d56760c01ca0ebb73f9cac36a

        • C:\Windows\SysWOW64\sysx32.exe

          Filesize

          7.8MB

          MD5

          7b7d04d2c0bd8ac1f4923b0655baae6c

          SHA1

          e731959a1dde67ad20a3b86774d7592ed7241d49

          SHA256

          452d403f1deb8d49e91d37929616e2b7b377764ed11648df6bd5a6e2c8740c7d

          SHA512

          a91eb78116db32e2cc23195545adc4976ee4b2f2e3361949a661396bb1a8b7b2f9060f3f29f43cd4256e8b763ab61a6f21781a8778bed9c8903c575435b13e39

        • memory/3616-263-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4240-780-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4240-778-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4240-1866-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4240-2721-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4240-2723-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4240-2725-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4768-0-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4768-265-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB

        • memory/4912-779-0x0000000000400000-0x0000000000411000-memory.dmp

          Filesize

          68KB