Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 04:58
Behavioral task
behavioral1
Sample
cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
- Target cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe
- Size 79KB
- Sample241114-fl4adsvdmc
- SHA256 cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad
- MD5 39143ac6f80ac712d6af14495804e663
- SHA1 6f436b66fae5b2bc85eb5bca072e3d9c49822180
- SHA512 a26776cd90dfec46e3e9dce2acdb68415837891d56259bf7307b521c3a7d127a4c9d1ed6909ee727b1b2dd05fb5332f33a172297ada3db18acb261de2a12fa41
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rL:V7Zf/FAxTWbiVRRNRR3EBba/Q
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2060-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000d000000023b83-2.dat upx behavioral2/files/0x001400000002292e-6.dat upx behavioral2/memory/2060-750-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe"C:\Users\Admin\AppData\Local\Temp\cfb413a8906eb5158ce108599a95a2eae63696e5c9251c4f221437b91ec334ad.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp
- Size 79KB
- SHA256 09764576150be3e06fdd07244e478dd97ef3af66cf75f653b1d95a1623c94793
- MD5 2bd1773278fefe7ac28f760d60b70bd7
- SHA1 450aadce1084da3b6f1e5aa5f5d686be199bbf56
- SHA512 f4aad107b1cb4d9f852fd001d3c655df1480af1181ab321d4fb0da5d938dd02bbc95283a3ed5d1c43b7e77e2cde14a7f74cb1882d55fea11ec48843822882e08
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rB:V7Zf/FAxTWbiVRRNRR3EBba/e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 178KB
- SHA256 1e224b5c980458a60c1c169a8a90f9adf7bbebf570002035b5c6e505ad5ecab8
- MD5 29f46b6639a417d2b4376d4f4501ab4b
- SHA1 ddf5da2178a2f9a132e0436ed659f52466acd018
- SHA512 9dd54d054cb41afad51a0bb4168bbbf9a30731af1a0df50b1c1e3ac8bec31eb03c2535930e15be64ed545aa735cd562693300e2240957c3f5cc3e584c6ca8e58
- SSDEEP 3072:fnyFRrR7/aWHIjN3tj6qnv0b2UrXkbvLZ:KFRrRJIjNDv0bNXkbvLZ
- MD5 SHA1 SHA512 SSDEEP