Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe
- Size 51KB
- Sample241113-avv3gstemd
- SHA256 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253
- MD5 e656fbf87d75a065a1bceb988452fb07
- SHA1 e2d3f1569e25015e736c45e6ca41090e31ef6eea
- SHA512 ee7284b770590a5f4cab66a7b89435069c77cae0652e2fdea4c4b758808bb50bf92965b52f66dae7e513feab0caede1bc3a6ee22edb056d25ce7393b9178bf36
- SSDEEP 1536:W7ZppApBULcfpHLcfpyDcdyGdyab+obSfxDsH+obSfxDsv:6pWpBwchcwDAb+obSfxDsH+obSfxDsv
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5022) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe"C:\Users\Admin\AppData\Local\Temp\90e2c80d250a456b06a8e92f97b05026b1da442ec397b7fc3d9f788e89bdb253.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp
- Size 51KB
- SHA256 bb431eb9114748abf123c7b8670ebaf52b0727ba2f2563b645acf92016870d2e
- MD5 32d5db882ac4589313df6388735c7789
- SHA1 930c31d43e4e2aa899cb0031594b7680065078dd
- SHA512 430f72e6f6830b19064497a38ac3c5be947255b6d3b66ca3810b92bdac045bd3158a336e7f34b36412cb26cc1f9603676a94dcadbfd91fe2cd4f95ee13bd1384
- SSDEEP 1536:W7ZppApBULcfpHLcfpyDcdyGdyab+obSfxDsH+obSfxDsr:6pWpBwchcwDAb+obSfxDsH+obSfxDsr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 150KB
- SHA256 d7f66a7bf2c8a256d9c5aa827f486f41272ada05e8b4a5bbd1453d8a537d6a37
- MD5 90d91f599da595e550cd2085447f7abc
- SHA1 17e47fca7feef919af718c5a428e5d797ee7931d
- SHA512 eb60809b893597bf0b5de963b078836b3545d56e8da62fbced49e473fad36688a6a4330840351fbf086be2ae566627402f95276eac485bca039d4cd11dbd573e
- SSDEEP 3072:6pWpBwchcwDAb+obSfxDsH+obSfxDsYWHIjN3tj6qnv0b2UrXkbvLR:P07IjNDv0bNXkbvLR
- MD5 SHA1 SHA512 SSDEEP