Analysis
- max time kernel
120s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 00:17
Behavioral task
behavioral1
Sample
6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe
- Size 52KB
- Sample241113-alg49sterm
- SHA256 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948
- MD5 0bd519b17f5c46dba13128746dd307ab
- SHA1 d8fedad1694c89dc9a3d8f142343bff5ce92f0ec
- SHA512 81eeaeef13f34537f5b52f20cfbb36f3b36491fdd9c678fc5d7c328b860f10b2951c0e0bfb3e13547b2a66af8b9329a8aadb3da74bbaac2cb2e536a43066866f
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9xj+N1J3DCl4N1J3DClVDp8UmwK:CTW7JJ7T/j/DnmwK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/964-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023ba4-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/964-785-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe"C:\Users\Admin\AppData\Local\Temp\6ff029ad787a69dca7484d57eda1d58a60c69d6b08c4e140bbf1281f60199948.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp
- Size 53KB
- SHA256 c47d36f328a834250a97d6080cc8c8b28eed9e3d24a7f6624300c6b2e35eb85c
- MD5 833f729d1b2e652e2d027331594888d2
- SHA1 7e2998d00cfaaadce4f2adbbb5082ae37fcf5373
- SHA512 ec7ae223e6711cc51e455ea851ff74893f4d7456db0ae83a001bb0419efa0ff20efea96d77e8789159e6d8b197cd762d45609cd262bdde8a268b0dba76cd7764
- SSDEEP 768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9xj+N1J3DCl4N1J3DClVDp8UmwI:CTW7JJ7T/j/DnmwI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 151KB
- SHA256 327fce158aae013d6524e8f9b69010564b5d92194fd2aa5048dc3707110cccfd
- MD5 dc8c3c25165d7c87f872231865a1b4dd
- SHA1 4daf1f4e4dd2d5f8d24f4b8d9931dafb5b4f878a
- SHA512 ca9d777617c2085bfb7deba3d9b04c2823052567fb4f811ffa387fccd69e0c67eb882e468de8c9fa74622a6b01726cfbbd87fe305f514ee993fa4d940001eaf8
- SSDEEP 1536:CTW7JJ7T/j/DnmwF4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0Rp0:hjj/KwIWHIjN3tj6qnv0b2UrXkbvLQ
- MD5 SHA1 SHA512 SSDEEP