Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2024, 00:28
Behavioral task
behavioral1
Sample
82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe
Resource
win10v2004-20241007-en
General
-
Target
82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe
-
Size
81KB
-
MD5
171cde1c1d76424e195abf6abcaa3c6b
-
SHA1
09ba0304240759f6993caa51042a9ec4138fc350
-
SHA256
82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f
-
SHA512
ca07b02949bdc2f1efccd13ad7784a8b51acbbd2a804374a5eeeaab68b41640394f3a5b5f7b3a8f9ab0a2dfad1afd81cf7a3e522ff7d38dd3ed95000667f7bda
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxq:fnyiQSo7
Malware Config
Signatures
-
Renames multiple (5030) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3660-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b8e-2.dat upx behavioral2/files/0x00140000000228f9-6.dat upx behavioral2/memory/3660-666-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\7-Zip\7z.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe"C:\Users\Admin\AppData\Local\Temp\82edf59ccd9f405a95259f38d90957f97510f09b772e59645b8cf07ac5d4bb7f.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD525311d75794f0ee522674cf7fc933b22
SHA11a51efae5ebb597d49bdaa88a4e9c77215210c83
SHA2565ce51bdc1ded87b83d3056a440886b88653d882dd73c66c7c9f1663cdb76ae85
SHA512f69b1078de1837e283d7b4155963f8468c52f7b4e52814792d22285c9252391b65a5d37950961abd233e4d2c927b28e9a1228ffc4c4721ff2de041716304dea2
-
Filesize
180KB
MD55d3db97a2fc8bac870be5e71c9b64977
SHA1c69e0d68a45b940f3415ad896119ff0308030b7c
SHA2567c391c18321b1230cc06e203d1e9e48ed63e4b947193cfca4b6d1a1c0536718b
SHA512fa02d86b5a6198170d0fd1dbd2cde125e282fb62da85771074b30c7d5c040547257f26bfc5df93d72f5a5b4c901753fa8fb12565425f5bb5822f672dd234cfa6