Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 01:39
Behavioral task
behavioral1
Sample
7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe
- Size 75KB
- Sample241113-b3abesvalc
- SHA256 15aaf7b79b0425b74c3b31315e479918fa2e64c3705f92a9392d187727292940
- MD5 60dafb434a4abc16a8f6847fce2c5145
- SHA1 52314639ffc5a77f172579c1ed3f75ba59655e40
- SHA512 78813184c85145b4bf9800a48f26100324b09c8092645ca39aefea1b19f61f341a90c689755c56fbe73d1303a475a67b3dbe84169fc0d7c78c00534958e454f2
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rg:V7Zf/FAxTWbiVRRNRR3EBb6
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2928-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023ca7-2.dat upx behavioral2/files/0x0004000000022902-6.dat upx behavioral2/memory/2928-662-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe"C:\Users\Admin\AppData\Local\Temp\7333ca5ff9bb781b67b631b1dfe60aadb86a859367a1e5fef491831f8cdbbd38N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp
- Size 76KB
- SHA256 f255f9a6c41976371908d9bd93b78ccb347f984eb774efd4ddb2e555a91640ba
- MD5 96f3cb972755d0914cf7eefbd9edc434
- SHA1 2bc44e1c80d648f53958c89b2f697f9f1c7642cf
- SHA512 6c6a493b82d6580af098f4b9ab07b9b11c3b23435c3004291de198f4045e868031ab2ad4d7fa0b2f40bcffcf608ecebfe90dbaf9e89347819bc438c74c65c69b
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rQ:V7Zf/FAxTWbiVRRNRR3EBbm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 174KB
- SHA256 ca248bb26fc1656ac6780b543fcaad44bf2737cefe52eaaa4be45fc21da9fe56
- MD5 5425b700d43741c66b0876c90955ee18
- SHA1 e297b48e137093d1eaf9992b6345d31be665bd80
- SHA512 ad05503c5028fc91eea3cf28f4edc69e09bfae678309404c8a1c55d8b927f30247854fc50d32add49bc137262b80ad5a510b7c8e301afb7bb20b9b6b68be409b
- SSDEEP 1536:V7Zf/FAxTWbiVRRNRR3EBbW4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2Udpj:fnyFRrRAWHIjN3tj6qnv0b2UrXkbvLC
- MD5 SHA1 SHA512 SSDEEP