Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 10:16
Behavioral task
behavioral1
Sample
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
Resource
win10v2004-20241007-en
General
-
Target
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
-
Size
87KB
-
MD5
c7be29851b7daa7f6c10e70c28d98a8e
-
SHA1
b1b27b50ff3e144bba6b0312bdd4c9c866ff6098
-
SHA256
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e
-
SHA512
ae28b13a18680b647850b75a6f661d94c1bdba606b6a1e8678cce0d5aa29309e587a54bbe0dd03c4722d2456cdca2ccd87939cbb7e6914c66c12abb692155714
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBYMp:CTW7JJZENTBYMp
Malware Config
Signatures
-
Renames multiple (4207) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral2/memory/3248-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023ba4-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/3248-659-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exedescription ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Java\jre-1.8\lib\currency.data.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe"C:\Users\Admin\AppData\Local\Temp\4b2bf32a8de1d9b20fdb9f056689d9dc409edac5c0f5e844f77269fd48fdfe2e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD56dad3fe591c1105edbf57b8aa0b9c8d2
SHA122786d7b32a930461f3f44eff5decdb5ee0e95c0
SHA256871c96cf8f1456158dbb141062fbbf17eaffeb968d3f71eff2d7c16f11b945c2
SHA512975fe47192d444a638493db97003c56636e8d4d6a5c8328cfd7c2395576d694a5c31e9dd03c03bcea19eb98defae9d6805ccc90d54c0d06658c76a626ccc2971
-
Filesize
186KB
MD515a315bd301438f3dedf50682984cb6b
SHA114ce20f79a7d5f3db79abb260476d5a0087f06fe
SHA256c94152b8f45232cbe12f0d983ab3f412785d0a9b3e457e6ed2336e82d9d021ef
SHA512b423ebabe46ca6a605ca3ae07b8f44e094026bbc69bce553d6280a025e214ab8284e774d66c6feebd21b9e871146796c12de1da4271ddc27d4dc0434e46c60b8