6ef426c0ad0d12236eb157cf78a32556414836cff0eaffa9b78dca5c2e6b35a1

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c8de4ae269bd069d31a6962ea522260N.exe
Size

52KB
MD5

0c8de4ae269bd069d31a6962ea522260
SHA1

85a158df984fd60500b03a8cf64ec7008cf6fc82
SHA256

6ef426c0ad0d12236eb157cf78a32556414836cff0eaffa9b78dca5c2e6b35a1
SHA512

16f21da3a6e11d129657f1c7e7cb6a3bc103d4a21de7b476cdc28658711337cb1e3c99d0558f4b81d8162bf840588ed2de743c2d7fef2c83da6d3eb748604577
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WaEdW3WtxTxlnR9v98:W7BlphA7pARFbhvOsTKnKqtI1Zhi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\EditJoin.tiff.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\nb.pak.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	0c8de4ae269bd069d31a6962ea522260N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c8de4ae269bd069d31a6962ea522260N.exe

C:\Users\Admin\AppData\Local\Temp\0c8de4ae269bd069d31a6962ea522260N.exe
"C:\Users\Admin\AppData\Local\Temp\0c8de4ae269bd069d31a6962ea522260N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
52KB

MD5
d6a76a49e8d346329eb549ae6a3af51c

SHA1
5b92f1816a9983990ca175e959b09c95dea0e40c

SHA256
671e1a3082712dc33e190c2eb91ecf45850a4e7adc98f3efc25a1a2c213dc950

SHA512
31bb95a6d282ee52ea30c252aad98ea117f0e12b6c0b1d35a0b183baeeadaf0c8a326593c5b21277d3e0c7b49682ec7b7f653c5e410fcd11be959b6cb963f87c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
0c745d8366d584f3b52a65fbdf90e6d5

SHA1
268dd721c35829bb53daf4430b0b453d30849e32

SHA256
4b63cd1c99d18f7274d8eb55e9053b0b4a05e9fd0b37024c0e9f1bb585419f98

SHA512
261780e27e70d58a96b4701f1312ccd4515d5031947b68e088f5796c408574d845a3841cd4f1cfa54016713681497c5facac57211784d884aab07f8aa6962c85

Download Submit