Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2024, 01:07
Behavioral task
behavioral1
Sample
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
Resource
win10v2004-20241007-en
General
-
Target
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
-
Size
130KB
-
MD5
ece0854ff908fe5521f959a11ad5a940
-
SHA1
6e5772edbcf2e3b46a3216e20ebada742f3d2aee
-
SHA256
07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1
-
SHA512
5b7aa294cf872f4da10ce5cce681ff7ead404e05ddf46686791c45c37244aff868342bf06d61a81df05fe7170161789918b9847133edeadd12c81bbe8740430e
-
SSDEEP
3072:hoRUhehbIyIMQ4Aa1ZthsMxFUy4ipiIUpB6Bo:CRUhehb15QYZthsMxFQJIUj
Malware Config
Signatures
-
Renames multiple (4302) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/5104-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000d000000023b7c-2.dat upx behavioral2/files/0x00140000000228f9-6.dat upx behavioral2/memory/5104-657-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe"C:\Users\Admin\AppData\Local\Temp\07d89fd019ed60832ace1226a3a920bb24aaa9cd2f014d310f7924853579dcc1N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD5c0b958a927b0a94ac731b8d3c35ce47d
SHA1934a530781f66f8c19200bf2fe2d771faa405389
SHA25659502b10ef028788b567bbd8a583131d2fa90394969c09e9eafc48c7b7977183
SHA5127c5003500d3a8cd130670c330dd5484151df0afebebb114bac3a678dc3722f593de07bf2da916cb1e8dcd19f6b0624480dacb44a436dc57110443875f7a4c747
-
Filesize
229KB
MD5393270c28defbcdeb22c68366bc55f42
SHA10c8ff7d3224333c534d88141695d18c6e68b4788
SHA25675b98b8517bbb56c8467c25e5c68eadaef4c91626f7d9cd496fbc031539ba35c
SHA512f3a6a975cdade5d6860237775d85e45b4b6a2ebb93c103f4e4442e1262186a3d587479ccf4035dc80502096d6d54cf26209c4178a5fedb1838b261ac9a8324b4