Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:22
Behavioral task
behavioral1
Sample
a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe
Resource
win10v2004-20241007-en
General
-
Target
a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe
-
Size
75KB
-
MD5
ed27a85599545084bca8277c5599a480
-
SHA1
11e6288d97c30fcd5a7c9dd13b0525f4efa72086
-
SHA256
a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062
-
SHA512
83f7fd0131f74a1ee4103bb97db43c42c68bb5c5c265bd98f89ee7c843c389f625244ce1f16a1a8b35edbbb9991ca13da33f55c1be04790ac627d4aaf49b72ed
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2r3:V7Zf/FAxTWbiVRRNRR3EBbIOJ
Malware Config
Signatures
-
Renames multiple (4871) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/1852-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp upx C:\Program Files\7-Zip\7-zip.dll.tmp upx behavioral2/memory/1852-660-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exedescription ioc process File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\7-Zip\History.txt.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe"C:\Users\Admin\AppData\Local\Temp\a69bf2de681ec97c1f9af78fb337b786bf0a8b792c89f05bd9f40ac335f66062.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5fba55f6472ea5021d193f0af5d0b48cb
SHA15e01ae2a4c1399ff3dc19b32f580719d8aed1182
SHA2569fb40aa3b64673c760ab7b8cf57b40139980fdd9c93b4e0467490f8f1a9d6a0c
SHA51253e9e264d8237f814e84d012955e1219282834a1ec40de1ce6a209381d7519e6d4fbd43a70f56e4207ff7aaef75a57cce566b6905c7c492ec768763323580806
-
Filesize
174KB
MD534f40f8f4c30d5c4f72c607114f6d2f4
SHA18c407c3abb998292139895f07aeb3fd848352c44
SHA256e2d0d1e14e816e4a4c83b99749041929ad603c812d3a33f3c78399b46e4a2e0f
SHA5126d11dac884ba44645b7cc6108801ba2545a58d3dfdd4f7713b37377b6f4713564f902124559ddded7eeb0691b61b04df7ce675ce3c29ec4c523f566bf2a076a5