ac7e2f764051dfb8b70658663e796e239d84e48c817cec7fe4b2115c21b4f029

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b2b3f929086e8c630ef5d7c5114c0a0N.exe
Size

71KB
MD5

1b2b3f929086e8c630ef5d7c5114c0a0
SHA1

ca761e62500ab34345e363ed41ad716d0c28c2fe
SHA256

ac7e2f764051dfb8b70658663e796e239d84e48c817cec7fe4b2115c21b4f029
SHA512

aa9f87847412f3b693484200952797e7a146c309e18addd70324c60477a26ea5c18a2edadf2773f3d1ac77ec96d653afe5138daa68e14bc725b62a83aa032c11
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdK:6e7WpMaxeb0CYJ97lEYNR73e+eZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4530) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\es.pak.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\en-GB.pak.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	1b2b3f929086e8c630ef5d7c5114c0a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b2b3f929086e8c630ef5d7c5114c0a0N.exe

C:\Users\Admin\AppData\Local\Temp\1b2b3f929086e8c630ef5d7c5114c0a0N.exe
"C:\Users\Admin\AppData\Local\Temp\1b2b3f929086e8c630ef5d7c5114c0a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
71KB

MD5
63ccabfce9e7c33500143490fd92e97d

SHA1
c728c27a47fdc4b7cedc8d8a33236fdd17186302

SHA256
485edd0615fcd01be9cf8af32639ef6f093f5d96b16769a3c365ac2943bdd661

SHA512
1f26953f88061b97f51f74535a90237de8e99afbff8498eda3861ae3bba74c451a557e5ecda7439a1ba4972f5decad4cc84ea56bc9a74ff61af08e953c87d313

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
12b2cfbb7a33d8887bc9883da66c6865

SHA1
76dc04228f5cbbd9ada1ac3ab3482e32d54803a7

SHA256
38f2ac3fc10afa707ab2db160477b3d0c8dcbeb98f899fa2cdeb34a054afb2bb

SHA512
91efc020fac6005b7327c2da82adaece3f25303af33f962fdca5068a00e0a97d661926d3076313766e2f1c8661190ff1041d922ca190179aac671201125091fa

Download Submit