Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
- Size 78KB
- Sample241114-e4ybestnfz
- SHA256 f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3
- MD5 885001f868bdefcd5cd230efa4da56d8
- SHA1 f40c84ba3f6ed6d1d7fad444a8b6046b82c8de8d
- SHA512 e7b40dbe68c4ed1b4b204a5919d0970a4d9efb35636a2e3fd41fb653a74b973cfe7b8097a6246ae0018c54cb5e5593295e3981787d12972d97a75ad44cb9cf14
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeB:W7ZhA7dAynMdyGdy4AnA4QLIyIBs
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4618) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jre-1.8\release.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe"C:\Users\Admin\AppData\Local\Temp\f9c1ae884f64f613333e70cf1aca7bf0c4e0401bc97ed5ec6ef0f715d69c30e3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.tmp
- Size 78KB
- SHA256 1900c584dc16687c23bf28a90401e233c223f206ce8112a7671307d46df8c101
- MD5 61550b93b076f65dce02842f65382ed8
- SHA1 276c83a5862d43322859df89c930697fb6b8480a
- SHA512 c2820dca6b774b1f39da0d47c455562747a46eb64470ed41d08576ca3e89f32d1c452a232d4d9614e846ea555b052fa5113093cca70915140625986429f7a44a
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKe/:W7ZhA7dAynMdyGdy4AnA4QLIyIBe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 177KB
- SHA256 6139fa112a57f84f15cb5baefa27570789a8364ef6f6963de57dd7b93c4ff05e
- MD5 f88cb517df4341a8ca71f67d1158fac9
- SHA1 e22b7091ee6c90384079b8c276bf9bed65355ad6
- SHA512 7d25c63e703b47a46d820a03c70e9bed14a9c133b1d3f6bd57a0d1cde135003c18cd120fc71f811ec2414ec1f0ec234137c30cbb2e43d613ee970715a32fb0fb
- SSDEEP 3072:6e76ynpADIyIJWHIjN3tj6qnv0b2UrXkbvLW:ReynpAD1FIjNDv0bNXkbvLW
- MD5 SHA1 SHA512 SSDEEP