Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 03:22
Behavioral task
behavioral1
Sample
dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe
- Size 69KB
- Sample241113-dw7dpayncn
- SHA256 dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683
- MD5 448c117956f04a05eb6e1d64c847632d
- SHA1 15db76ea30e36fd2431d624ffd5bd4b2dc229573
- SHA512 187c8354a1a794a47bdb9ec201f79835aa1951404a1e07c0785b2f3cecc7582c0be5a4576d2383a23feec6acee59653640deaeda63d927cba1bb5371e443f430
- SSDEEP 1536:V7Zf/FAxTWoJJZENTBuTW7JJZENTBdQoLpQoLw:fny1tEVtEU
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5119) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4512-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b28-2.dat upx behavioral2/files/0x00040000000228f5-6.dat upx behavioral2/memory/4512-784-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe"C:\Users\Admin\AppData\Local\Temp\dc6ed735f2a599261f0f9fbe079184c07d04b961b5c845e4bb07f190d028d683.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp
- Size 69KB
- SHA256 ff6bd1bf7107eca674140fc80cf310ff53119d3d58c2ab4cc9cd8ffb49024902
- MD5 18a1d172ecd956fe9503c9b77f8e7cd4
- SHA1 1f9425a9e291d971e71ba545e0ec49147f71eee1
- SHA512 f3a55a93a2e704640bf17a39d3ef89456bb60ffe01420db6090fd2edb6d9814e7698499fb51efe5eea945132f572a1acf164a4e10e0de414ca67b9fa65e1777c
- SSDEEP 1536:V7Zf/FAxTWoJJZENTBuTW7JJZENTBdQoLpQoLy:fny1tEVtE+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 168KB
- SHA256 8d1ec764c5859978169ac0ba332fc6656195e27d12f0956de5f35dff1b84aac9
- MD5 4bcbbe918298c94777a12a323210de4b
- SHA1 7fd7e0c19e6f1da8eaf221d93b76cb1a99410209
- SHA512 f0f7f480eb0bb28b202097750601df3686c6da47d4c5101d96b8603cf2266141a2d463a57c4a090317f4e639e15f9105966e76f238631ae540e96e969268132e
- SSDEEP 3072:fny1tEVtEpWHIjN3tj6qnv0b2UrXkbvL+:KbE7EeIjNDv0bNXkbvL+
- MD5 SHA1 SHA512 SSDEEP