46bd00f403d88ccdccdb5ecb6b78273b2cc4b97996651dab664bafbb6da44bd1

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02917c7f1958d477efaf55e321ca30f0N.exe
Size

67KB
MD5

02917c7f1958d477efaf55e321ca30f0
SHA1

0889a2974e60d9aa224816e5c4ac05057f9ab5fd
SHA256

46bd00f403d88ccdccdb5ecb6b78273b2cc4b97996651dab664bafbb6da44bd1
SHA512

b3bc2fb738f5ea9384ce2d72b7b0f902af37065087ca5a62b3d9b034aac430d3ab593b0c2b1f6fa483b1abb975174200c54b3ecb8dc6724ee11b3061355f2706
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBfLr1:/7ZQpApze+eJfFpsJOfFpsJ5DHa9Ia96

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	02917c7f1958d477efaf55e321ca30f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	02917c7f1958d477efaf55e321ca30f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02917c7f1958d477efaf55e321ca30f0N.exe

C:\Users\Admin\AppData\Local\Temp\02917c7f1958d477efaf55e321ca30f0N.exe
"C:\Users\Admin\AppData\Local\Temp\02917c7f1958d477efaf55e321ca30f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2077438316-259605770-1264560426-1000\desktop.ini.tmp

Filesize
67KB

MD5
35d0b4e318da7cfc9fb130ed06a6eca7

SHA1
b97b045249a641f166070067ed6c6223106b1120

SHA256
54e0a4f7026dc6a83d5e11880b4c16fd956116e90d2829cd64777c60a556eb4b

SHA512
396def9437a8b187dc27cad4b3a0c1623028d48a7965b83e78eeda191f4157e465e1e19ad2744dc02f41e8bed22a28c3ae98b972aedc07ab7c67b33b880cff77

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
166KB

MD5
184f810cdf1b22bb7055f174609c60a9

SHA1
d1cbde81764566795a9cee43ed232f7bc88e0c6d

SHA256
0bc9263e1a0ee41c4ae7f0f1372428baf43983e6c0332929fcbe5a653d657cde

SHA512
977ca63dd814905a2983650cf2f95313b217700a092ea4a2e53fe527430cd109849b9e49f79ebcd4d12d4afdbf4bb1dcf17d9acc9679893a6e0059a6572cdd8d

Download Submit
memory/3152-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3152-1934-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download