9179eb1895a9705549993adb37ef8bbf6220462f5295cb2f41e4672b3ebc6a1f

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05bcc7def2963674f7607f10bd288ef0N.exe
Size

43KB
MD5

05bcc7def2963674f7607f10bd288ef0
SHA1

2a54c947caad0d3df6d1309b1de24981183621f5
SHA256

9179eb1895a9705549993adb37ef8bbf6220462f5295cb2f41e4672b3ebc6a1f
SHA512

841953fa73d14a0d124a626b1af0d4f8d7db19e79a307d96a4548e9286dd0464573f72c2f56cd85692a7427286032f61748e2f366a0412de61b6ac5c23889f79
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpT4wWlsAtJVsAtJ5:W7ZppApBULcfpHLcfp5WN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4683) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ar.pak.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoBeta.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	05bcc7def2963674f7607f10bd288ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05bcc7def2963674f7607f10bd288ef0N.exe

C:\Users\Admin\AppData\Local\Temp\05bcc7def2963674f7607f10bd288ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\05bcc7def2963674f7607f10bd288ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-807826884-2440573969-3755798217-1000\desktop.ini.tmp

Filesize
44KB

MD5
5d0f1830848b469bc6af068cb608b41c

SHA1
5b0aa6878e806bdd9a5fcdef3c1f61f46b316943

SHA256
1977cb4e3b1c04a48303bfb8461fb7bc4944525d69451e0eb3a78154096089b1

SHA512
4f2bd15e337fc9183d5a6572b81550870236b6e2a8af3ee75b6c46a4ba3a7b3bbc61fdc02b465a3cc22c570cb16418dd86a99b4f0400a6d5f46215381c5d986e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
aa88067ad04737d55d26b7eaf2f59e3d

SHA1
e2da151c33d44bd4423d8f9f40420157edf3f70b

SHA256
c833da0dffa0a04e516c8774ea36f8d23fe5f806e21aeac978e1b7a55cd6e50e

SHA512
ac6b9abdfb2a7610ba7190b3c806a2e08694a075a73048abe58c430b57c6ac8e8fb9663f400ebd42092d39824a93d2ffbb32df6a93dae69cddba260f3bac6050

Download Submit