Analysis
- max time kernel
22s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe
- Size 117KB
- Sample241112-b7beaavmbp
- SHA256 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d
- MD5 b2d1370903a175eff9c90ec14202cce3
- SHA1 23722c8a55713c8b31e07cb513c76ae51a65b224
- SHA512 d6d3c96829cad3393f75e92c4093bacb5a23e9c819db14e3c810e958542698b9a0827fe9a84dc8c16caf8f048fc797b6082d9c6c4875e679a7f7a92b565c3e07
- SSDEEP 3072:PDo+dJ5lVurLhYoexFt3ToadQ1fbG5hxxoP:PD7dJn0LeoeGPbIe
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (58) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html.pif 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\7-Zip\7z.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.html.pif 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.pif 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html.pif 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\graph.ico.pif 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html.pif 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\javaws.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe"C:\Users\Admin\AppData\Local\Temp\63251006502766b3978e05240505635cef23899fa561788241aa5fb62476af2d.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.1MB
- SHA256 d81db2e2a9bc96cbba92b3eab7f05e8f627aee820e7f5686bf54399e998ae62d
- MD5 fb110da815e2d6c2af34aaafe9e2e8e4
- SHA1 92aaa2727089faf4ec1ef951e81d4d022c224d92
- SHA512 e0ffc5aa5fd6fed63ede7a620b0f743bdba94fed2c9903a87f5d7e57b1fbb56f51607205beff4916fa0b4b56418793bcc13e023c1f25573f1825cb8ef76252aa
- SSDEEP 24576:xbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:xbRquA/m2yL5zbfFiV+XenmE3/z
- MD5 SHA1 SHA512 SSDEEP