Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 01:02
Behavioral task
behavioral1
Sample
9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe
- Size 34KB
- Sample241114-bd6nbsscqf
- SHA256 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55
- MD5 c7473fa98bf8ff29204574cef05b7e82
- SHA1 0785c3d26a7d62716d8ee04be03550c1dcb2442d
- SHA512 1ce3c400c575186beb072309d5c8d245ac5218bf5d2c5ddaf6bdaf5c909fec5f9e653d7ecce1bc8ebb9018502b08c36f4d4b0e9ed0cec7f88cd32afe8dd580d0
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PV15R5y:CTW7JJZENTBHfiP3zA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2292-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b44-2.dat upx behavioral2/files/0x0004000000022916-6.dat upx behavioral2/memory/2292-782-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe"C:\Users\Admin\AppData\Local\Temp\9f66dab7e3d3fdf5b1f552c2e39baec3b9661099e8571456a74196cc288daf55.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp
- Size 34KB
- SHA256 29bb63610f19f300eaf58b7f12153350646d7bb6868d18ce18f3e98f28defaa8
- MD5 53f1902fa4ef56a4c3d10b563ac59d19
- SHA1 de2d5ce38105e1bc4e9ad5b8f0f5c8dac708812c
- SHA512 1a1688d550226313b575e3ba5e75e76756bc3b3942392307f1ccf201e37c8273384a3d1b8109c706f617efb1f939019b88b7a85803d62d0ee3b9d0c93bcc4a39
- SSDEEP 768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PV15R5+:CTW7JJZENTBHfiP3z0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 133KB
- SHA256 17dee0edd0de109d9389f8bb3c08abd1f174b21b0eb281d29d203865ec07d879
- MD5 3bf9c2d70240b7f48ba28dda1c36271e
- SHA1 b8e9fcea030bd66f6b87dfa6492b4c9029c5e985
- SHA512 ac4d5aa6afd8f7acca284cc1a6e6400ddd2bf915976e9fb116aab38bf780c7723074f60dd43e63ef9bb4bf0878dc304b9580de51e1f43b70c2fb996ae20efd8f
- SSDEEP 1536:CTW7JJZENTBHfiP3zC4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0F:htEcWHIjN3tj6qnv0b2UrXkbvLJ
- MD5 SHA1 SHA512 SSDEEP