73e5a913a0d5a147d126c2beace76ddad374a8e3f3b3c03a784c3a5f8672a71a

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25d48c017f3b01d3fa147e3373b88d30N.exe
Size

51KB
MD5

25d48c017f3b01d3fa147e3373b88d30
SHA1

23a9f9d75fee82616f88e5fe9487f1148a43aad7
SHA256

73e5a913a0d5a147d126c2beace76ddad374a8e3f3b3c03a784c3a5f8672a71a
SHA512

478887a429ec80801daef4b816fd2b96078455fc06f901221b43f982c3ea6d119b8e0499963fc1e2759eddc89ac1817996f445d88a3420ed3914416874fa2cb4
SSDEEP

768:/7BlpQpARFbhfUnUnlW1VkRawAlW1Vo+L:/7ZQpApfWlLkLh

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3965) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	25d48c017f3b01d3fa147e3373b88d30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25d48c017f3b01d3fa147e3373b88d30N.exe

C:\Users\Admin\AppData\Local\Temp\25d48c017f3b01d3fa147e3373b88d30N.exe
"C:\Users\Admin\AppData\Local\Temp\25d48c017f3b01d3fa147e3373b88d30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
51KB

MD5
5fd278116630504644307aa113919fe1

SHA1
ab919490d958be7b333b246aa733b99e180f2d29

SHA256
256d8c9afc2e4f7f7f34e81e389c3d05925ef884331667b5b24c052731a10721

SHA512
4a20bf81b401e46aa6da493e73b156e1ab08e71480348697e1f8903001fc6db3669122da3dc5360c59bf7faa3cc3cb61458ad4669345f25a4f0e6cd50c476770

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
da50beaadac219aaca97e2f0a23c71db

SHA1
abb8bc587f392260d687ad12a3523f26b380afcd

SHA256
335973f105a5f058d66fd023b3073b55f304d25fbb2c4b11ba9330d371b4c6ba

SHA512
8b5fc7715ec0aa5d3df1b89957aeae73ec0d4bd5a337b88854d956e6e1bf048e36b6d3c71f60e62ce8ebf02e974a39473581332df962a2ed83df05bbc20502a7

Download Submit
memory/4432-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-1606-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download