Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 15:56
Behavioral task
behavioral1
Sample
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Resource
win10v2004-20241007-en
General
-
Target
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
-
Size
77KB
-
MD5
81c20fde6ec37ac57309bb5fb82de46e
-
SHA1
ee1bf25af1dceb9d149b1e511fc972e278478bb2
-
SHA256
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954
-
SHA512
59f04f44f5155abcc8da8951808f21c1e47cc38aea9e40a83ec2e1b29433defbd0959712f403d16ed04aad081e191e9b2525653b42b51658d339f66c16cb889b
-
SSDEEP
1536:CTW7JJ7TWsdj2hkAeCgI3i0CJS1Il+lMq:h6yj2yAeCgjJq
Malware Config
Signatures
-
Renames multiple (2768) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/1532-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b7a-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/1532-429-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exedescription ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\desktop.ini.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"C:\Users\Admin\AppData\Local\Temp\8d6564273ca8af02441baa54da943f6f2b7206d899325d97a3f93fb237818954.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5a3a14efc3cce4f7d579a549bfb10b183
SHA1886a128126f47f234ac5c729cad8aa3280f05910
SHA256c49a4553ba534db13569146f1fe4e4249ee976f02f4ddb3394f56f86b0b8152c
SHA51281adb3d1a412eb9589d4a3f017f3ba4b6788b8f0cd1b67300d965969b40b0a80cadde71a5faf09d63b4e5a105cd90761c854aeb68c3e1be314213b7fd71c0a37
-
Filesize
176KB
MD59fde4aa7f95e35fc7d662f084f03efae
SHA1c7c098bfdbfe18ecc6e7990c49596767247809dc
SHA2564cb4e99d143b44fe3d58f3c47f3ce376ad34cbf9d4b3ec4963365b4c0badf96d
SHA5120cd62cc9536f496716ac25ea10fd018577717a2ce60141c743ea3fdb8876067ca1e1e16a554dbcc410699a281c87226747930519e224b434480a5d39fee16ebf