Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
Resource
win10v2004-20241007-en
General
-
Target
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
-
Size
64KB
-
MD5
5b072bfba9e4f68225aab2ece0b9c3d0
-
SHA1
b26e1f70a8af91f8fabf191b8b8b8d11633885b7
-
SHA256
fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252fa
-
SHA512
435a3bb81e4f39f8073d8bc6546f60a2f4030a6d414d5f641be70554b43d88fbbe7c6036dbebdf2aa14a7f539efeb40d7760aaeb0a1e06fb986e8b3177e7275a
-
SSDEEP
768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeX:W7ZhA7dAynMdyGdy7YRY1tvtmZf
Malware Config
Signatures
-
Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe"C:\Users\Admin\AppData\Local\Temp\fbcdb160fda084422638c750c67a0801c46bec238daa6507272e81f90b0252faN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD59e8545d9aa984f71e9ee83c925a09d71
SHA1741a0344695a8f8e859e8a57b06d63b45be54285
SHA256e0d29d32f7977cb636c454b20da05bfcef34b7b8422f2f54f1275a0b253bc888
SHA512059b189809ec400439a96d6e828ecc214fc2469f4f56ff4b13e867b20511c1b362ed7c5a04688d46679b271d327bafebfc1b45044e269f6a9e345feb5ca2a12e
-
Filesize
163KB
MD58cf225fd5907cd8c0488947e4b148168
SHA1d9c58449853c3593ef18aebb4660135ff9aa1e84
SHA256d31b0a3fd9d6f68d16dd25bf5469b44339d09a0f1300e4b7b5939a7393e49d51
SHA5128ff11ee538770916131329157c51f87bc97101d296dd3931123e93fcb3ea801c2afe27c490f4a60b300cfc2d3c662a25d51c0fa7f24cdcbbb82b116bdb6214f5