Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 23:01
Behavioral task
behavioral1
Sample
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
Resource
win10v2004-20241007-en
General
-
Target
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
-
Size
40KB
-
MD5
4c1219df18de3886fbe65bd327bd81f7
-
SHA1
d4669db223310bc334d5ac24ca157f4b7eb48cab
-
SHA256
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511
-
SHA512
e5870088159681b726c6f3ea8d6da70f1039679bdc2dff477f709111be0f6abea60d8687f6e76ca12bfb901a4179a57e52daf13430efef32d6d55953622369a7
-
SSDEEP
768:kBT37CPKKdJJTU3U2lRtJfOn33EskmKs333EskmKs4gNAgN0:CTW7JJTU3UytJfOEfmKjfmKEH0
Malware Config
Signatures
-
Renames multiple (4537) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/2400-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023ca4-2.dat upx behavioral2/files/0x001400000002292e-6.dat upx behavioral2/memory/2400-642-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exedescription ioc Process File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe"C:\Users\Admin\AppData\Local\Temp\6e14e206498ffd1b3ff9681b86ffaec684e20e5f847041ee299611568b9bf511.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD539c66ef4669f331cdf483577c1171c45
SHA1f7af6c11b3a2ac968bd56b4427a8e70af6e15a1d
SHA2561fa01741d0d84e61300baf9ec176aa09012dbdcd1fb0faf27e70eb2206e49517
SHA512d6363276d596e737d3907eb370973ad23c780d92647e730baeb88756284f658df386db4c04371e321d98a21b58e5d52cd7a7740ff3c1a669f1cc5efd44b834a3
-
Filesize
140KB
MD5ef2913b297fe7ace563b736a41ecb2c3
SHA16cee6b0206a8840b1999d18d1b09be8245ebcbe4
SHA2560040a8974f401b1aeca588310fbd78edaf4065590ae80cea0be62972b68ce2ff
SHA512a4c6541bf96a93279eb33ab9334638c665369e4f2e7a7c8e126edc17ca072f6f65edc6e413b68c4ae5bcf20af70157a9a1fef2611f551adde8f881e401d1192f