Analysis
- max time kernel
33s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 02:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe
- Size 218KB
- Sample241113-clltkaxqfr
- SHA256 bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6
- MD5 8e39ff336837058f8fd5d3b0c10afd29
- SHA1 ae45fb2c42e7f9648c94e24c9ba9ca8c8f15d054
- SHA512 df4dcd85f895a771db4913b70b0e33e46b6de2716de234e97e43709b7d11a5758fbde027d4692ba3760a462fe1ee55559ede1d9fe656333e20555f5cc1d60727
- SSDEEP 3072:PDCVqSwKKzaLduxEnUHoqof/qKVp2w5OdQpC0B+QSThqEWRt9PKgrlvHsiUN05Ru:PD4TbQgqkpCQxB+7Ig
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (58) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\index.html.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\index.html.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.pif bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe"C:\Users\Admin\AppData\Local\Temp\bab11a50b9660a9854f14db5da15919787d8ba7ae94915a5414f95a3a262bcc6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.1MB
- SHA256 d81db2e2a9bc96cbba92b3eab7f05e8f627aee820e7f5686bf54399e998ae62d
- MD5 fb110da815e2d6c2af34aaafe9e2e8e4
- SHA1 92aaa2727089faf4ec1ef951e81d4d022c224d92
- SHA512 e0ffc5aa5fd6fed63ede7a620b0f743bdba94fed2c9903a87f5d7e57b1fbb56f51607205beff4916fa0b4b56418793bcc13e023c1f25573f1825cb8ef76252aa
- SSDEEP 24576:xbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:xbRquA/m2yL5zbfFiV+XenmE3/z
- MD5 SHA1 SHA512 SSDEEP