Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
120 seconds
General
- Target 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
- Size 77KB
- Sample241114-a2pt2svqgp
- SHA256 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93
- MD5 53cbbb5ab26120fb6937edc86d5debd0
- SHA1 27e4bf4d625a042ddd393083f5d635c6158766b3
- SHA512 bda39dd78b9700462f4104e5e728ef94400c3f8dd7195ba052623fce5294af8f518f028ef0cf97b8445ca792fe383cc239ce57cb972c861cd0855eb1b000bf2a
- SSDEEP 1536:W7ZhA7dAynMdyGdy4AnA4QLIyIBmJYAJYl:6e76ynpADIyIB
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4372) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\DebugSkip.raw.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp
- Size 77KB
- SHA256 42dc36fe5a433693fee543298287eb0dfac6f8b8dada6f8cae77ad9417670164
- MD5 0392594d5b9040358010f9557e55e855
- SHA1 7302352cac03b6d8975a8989e5d204b8b0f59893
- SHA512 59373cf074ab0b0bba64d217543c2b9e1a7f269d3e2f26d73c9e4bf5ade5274172ab30c39443e20f8d33c01f7bfb5dfe67bcb82000d86dcced4b32f325f93d03
- SSDEEP 1536:W7ZhA7dAynMdyGdy4AnA4QLIyIBmJYAJYU:6e76ynpADIyI4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 176KB
- SHA256 8ae613d41e0061bfe4c1a41d4c751402bf45f93e0aef5c4d87343066074664c1
- MD5 22ca865956960861445b61e854bb51ef
- SHA1 facaa80c66276258d0744291217633bbab51317e
- SHA512 e51e895f9e3d1ad5299c2f87b0a412878a6b03dbde7de9012540187c1c370bc1de2c97e0e750899bed0be56684bb0701b56a32d55580efd0f4efb2b1a36969b9
- SSDEEP 3072:6e76ynpADIyIAWHIjN3tj6qnv0b2UrXkbvLy:ReynpAD1gIjNDv0bNXkbvLy
- MD5 SHA1 SHA512 SSDEEP