Overview
overview
10Static
static
70323b4326b...02.exe
windows7-x64
100323b4326b...02.exe
windows10-2004-x64
100898a80dc2...92.exe
windows7-x64
100898a80dc2...92.exe
windows10-2004-x64
100aaecf7f77...91.exe
windows7-x64
100aaecf7f77...91.exe
windows10-2004-x64
10150e8ef3f1...02.exe
windows7-x64
7150e8ef3f1...02.exe
windows10-2004-x64
723e95ba676...7f.exe
windows7-x64
1023e95ba676...7f.exe
windows10-2004-x64
1028e7dc4aeb...33.exe
windows7-x64
1028e7dc4aeb...33.exe
windows10-2004-x64
350b0d6ae2...d7.exe
windows7-x64
1350b0d6ae2...d7.exe
windows10-2004-x64
33a6ebac4f8...ca.exe
windows7-x64
103a6ebac4f8...ca.exe
windows10-2004-x64
103fe801df14...4f.exe
windows7-x64
103fe801df14...4f.exe
windows10-2004-x64
1041367ad447...00.exe
windows7-x64
1041367ad447...00.exe
windows10-2004-x64
1048f4749f13...77.exe
windows7-x64
148f4749f13...77.exe
windows10-2004-x64
3499d936c22...82.exe
windows7-x64
10499d936c22...82.exe
windows10-2004-x64
104b5a6926ab...d1.exe
windows7-x64
34b5a6926ab...d1.exe
windows10-2004-x64
34bb0d8eb6b...81.exe
windows7-x64
104bb0d8eb6b...81.exe
windows10-2004-x64
5de3d5a337...ed.exe
windows7-x64
105de3d5a337...ed.exe
windows10-2004-x64
105e2b2fe65d...20.exe
windows7-x64
15e2b2fe65d...20.exe
windows10-2004-x64
1Resubmissions
25-12-2024 03:42
241225-d9c21axjdn 1025-12-2024 03:39
241225-d74ryawqfw 1025-12-2024 03:37
241225-d6fzgswqbw 1025-12-2024 03:21
241225-dwt4cswpdj 10Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 03:39
Behavioral task
behavioral1
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral32
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
-
Size
140KB
-
MD5
75a3cf8ced873ee7bc415e27e108496b
-
SHA1
ac94165d63c75f4adf1728aa2ecb776ac7c1c18e
-
SHA256
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed
-
SHA512
7c3e166ff75ad32f70bfb355167333be4f9bc5b5740a231b4a1fb5c391bd8e137ebea6a3ba5370797f016cbdb83631bb5e459e0bc64beb3246ed9605b3bdb903
-
SSDEEP
1536:HhwpMRUR8gpO3fM/CvmHWvW7l4y0RPG4UnmPqAibDe7bvjk/J0LcJQ6f8EPhQmGD:ZZi++b0Hb6bDIbvjkmwRPhuHmrOB
Malware Config
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Ryuk family
-
Renames multiple (86) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 3 IoCs
pid Process 1804 qEiARbqfArep.exe 2504 asoXNECVHlan.exe 2044 BnMnUjFEflan.exe -
Loads dropped DLL 6 IoCs
pid Process 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe -
Modifies file permissions 1 TTPs 3 IoCs
pid Process 1012 icacls.exe 1264 icacls.exe 1000 icacls.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\T: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\M: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\L: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\H: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\X: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\V: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\S: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\Q: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\J: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\G: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\E: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\Z: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\U: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\R: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\O: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\K: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\I: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\W: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\P: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened (read-only) \??\N: 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\History.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\RyukReadMe.html 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\descript.ion 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\RyukReadMe.html 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2152 wrote to memory of 1804 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 31 PID 2152 wrote to memory of 1804 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 31 PID 2152 wrote to memory of 1804 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 31 PID 2152 wrote to memory of 1804 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 31 PID 2152 wrote to memory of 2504 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 32 PID 2152 wrote to memory of 2504 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 32 PID 2152 wrote to memory of 2504 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 32 PID 2152 wrote to memory of 2504 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 32 PID 2152 wrote to memory of 2044 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 33 PID 2152 wrote to memory of 2044 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 33 PID 2152 wrote to memory of 2044 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 33 PID 2152 wrote to memory of 2044 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 33 PID 2152 wrote to memory of 1264 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 34 PID 2152 wrote to memory of 1264 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 34 PID 2152 wrote to memory of 1264 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 34 PID 2152 wrote to memory of 1264 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 34 PID 2152 wrote to memory of 1012 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 35 PID 2152 wrote to memory of 1012 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 35 PID 2152 wrote to memory of 1012 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 35 PID 2152 wrote to memory of 1012 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 35 PID 2152 wrote to memory of 1000 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 36 PID 2152 wrote to memory of 1000 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 36 PID 2152 wrote to memory of 1000 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 36 PID 2152 wrote to memory of 1000 2152 5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe"C:\Users\Admin\AppData\Local\Temp\5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\qEiARbqfArep.exe"C:\Users\Admin\AppData\Local\Temp\qEiARbqfArep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\asoXNECVHlan.exe"C:\Users\Admin\AppData\Local\Temp\asoXNECVHlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\BnMnUjFEflan.exe"C:\Users\Admin\AppData\Local\Temp\BnMnUjFEflan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:2044
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1264
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1012
-
-
C:\Windows\SysWOW64\icacls.exeicacls "F:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD50c43908b6d3fcc8232829073f86675e4
SHA1aa720aa4ea724c2eae1ce5325c6828126c9051b5
SHA2564076cebaa87b37943d78bb1d969bf7059494a303d53362f89ef61d54b5f07257
SHA51249db8d800000a89fe5ff331b90493451f82a7764fd2db82aa97df469e3a637324682d4558d32fa46132bc0f49fd1df8e56b97da3dccbedf6dee46a91dbf7e10d
-
Filesize
960KB
MD55596e892c082cad84099249483a8805f
SHA1199dee679aacba526cdd448aa0931800e4548bcd
SHA25643637b26d1390768cb491b325a6cf5de5c8a6a32b4d276f161784df485e4bdbd
SHA512280be7471c2b7753778d3bee40d93e1b280d0dc14b8c6beb38fa667c04f3d75fc433ca7aff551181fac50b97bbd3d6d4b1d6b3da63e092556d952cb39b93057f
-
Filesize
4KB
MD59c931b242ee9ffcc8f11e0cf3f352a17
SHA17d90754cb6a1cf576e158e15f057b3ac9fc6cc69
SHA256b58e21fb865367dbe985f99fd9d5625d22ef1081d8606f774dd6dbb5716c7ddf
SHA5120c39ff788b651188746faef4d1a0090467f00e2fb739bb9e1cc14fcd9da87976dbfbbeb4fc4a6ba283e40f66d14ed7eb575bcffd16fbee403e3c1b0de5134a72
-
Filesize
960KB
MD54c89dff443637b84011d10772ab10a2b
SHA1e1e7393baaebd3254e35f31b59f7e9234c394e08
SHA2561d763704f9ce405e4d112a7550de4dddd69320d1b43d37ad00d4369b0f752970
SHA512830e1bc9c3116fc3a545cb92f921ea094980ac7b6154e22fd16d047545a3afbfd012e29b3b3d1ec527c7ede6603539c4d5b781548f32fa6127d1bc3887ec3f7c
-
Filesize
17KB
MD58bd79c629be7c9a4c17be0668ab9e41a
SHA15ef633835e2120afc81cb8b27a348f50afcdee00
SHA256feb47bda30a3c7e7aec00dad9203fef7e49bb1e94c95d7052ec0c204954b24b6
SHA512cda4164bcfbdf68b9f1b4a70e3b16ecdad2a9f9d8cb4e9625a45c50931d968320fa4dc5db78ac72018bd0bcb2c116bc58605df706e7cd4a10816f3704f04cea4
-
Filesize
31KB
MD541b0006427b2224cb0987e1ad811073f
SHA185244d01ffe53dd2de7c036ea68a0c3a0df97c52
SHA2568a91157dd04e5af550b716058cabde6a5dbd28d8a1b7c3f8d2a38b548a1317ee
SHA5120b4c4377cfe800d6dfb8fd448fdc4c466d132a6173b3cc52b9a44914ca30759eff6208330fffaade3d2549855139cb4cd9612e79c6d3351790b21976f3e8a192
-
Filesize
699KB
MD5ac47e6d0aa7d124b478e8406bbe534f5
SHA12cf9f02d7f6084b852d4281f05be9f0aebbfaa96
SHA25651e329b0a4efa0a8b75c9f9715b0a05e00df6ecb33268988a560112b37926a79
SHA5123c08b3faf55845aa822baf8f0f28478e39677211301a3d986355e21dd99757576df52a0aa2aa6fa55ede3c3559ca3ee77f24ef696ed68d1bb6be379e0c919287
-
Filesize
128KB
MD57f1276842b192de978f53a32d195abc1
SHA13926bff0c5c1f4fd23bcdc56d30e65d0b33a68d3
SHA2561263c4457e86f0a9a91170af0553162595d54926e40faab89dd91131ce0a60f9
SHA5124b86b863d3efa8a2c9f3a88ab1b1a97d91ce9d0de288ad54c882309439e2dd6c6daefcb68ab534780c2adc7a4634daa184cdb673fe3049baa731a89e9ca60d4d
-
Filesize
140KB
MD575a3cf8ced873ee7bc415e27e108496b
SHA1ac94165d63c75f4adf1728aa2ecb776ac7c1c18e
SHA2565de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed
SHA5127c3e166ff75ad32f70bfb355167333be4f9bc5b5740a231b4a1fb5c391bd8e137ebea6a3ba5370797f016cbdb83631bb5e459e0bc64beb3246ed9605b3bdb903
-
Filesize
1KB
MD52a9ba975c5ce7e8d6f553a49d746ee9c
SHA116fbba3702510dd6968409993435405b9e6eb2ae
SHA25604c99bec6e100960aa418f631239bcad1e58ea153fcf672f8a55e4395fb904cf
SHA5127bfb2dbfa1155be795165fc17b269be566f8210b5c1a562f75a1dc2742f00c909cef027a466780cf8d786c11d0475f7c76fb761bd6e0c5af73d2c58ff0620d25