d9f976eef150134408dfc5fb74d40a785bbfd9a64287d7263d07c440f876ca11

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bb4457991dea06e51aae42ccf7bce30N.exe
Size

37KB
MD5

1bb4457991dea06e51aae42ccf7bce30
SHA1

9d501ab4171858a8d38de394137906382a31399b
SHA256

d9f976eef150134408dfc5fb74d40a785bbfd9a64287d7263d07c440f876ca11
SHA512

92c9f191e067fc73d69eb798d3552e95795078ccccd741fa969efaefcbbbe7e6a7b8f18348ec3eb20164c8079b01d2a0f9d8eeae3fb28c4729e6580ac7d9c9c3
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1e:W7ZppApBULcfpHLcfpSo3fs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\ApproveSwitch.mp2.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	1bb4457991dea06e51aae42ccf7bce30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bb4457991dea06e51aae42ccf7bce30N.exe

C:\Users\Admin\AppData\Local\Temp\1bb4457991dea06e51aae42ccf7bce30N.exe
"C:\Users\Admin\AppData\Local\Temp\1bb4457991dea06e51aae42ccf7bce30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
37KB

MD5
3c0fb6f6787a2d5ba674bf0b8ebe4450

SHA1
45a1c64fdef4e8f650dc9e92aced723438e3f15e

SHA256
f4aac0bf9512c330423bd0153cc2699d79d9fde1f04f8fedb931f825c114d556

SHA512
3a5ae22b478a8421b1fa5fedabb26b55ebe56ddabf8d4b274a78e3870b145a890f3af8b79ac2d822333eec0bce78ddce805ab0229a1268738547816c4eb9e97d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
37158be0aa65795d4d1eb353e3ddad6f

SHA1
26e6163433e6e41cc0af372f508ad71485f89a09

SHA256
2920ad35f302ecc4417f583dba9df52d895535630264e1ae0625b6664c61e370

SHA512
269ffe95cbc63f23e2f03bdd7b5a4f421430b9746aa166b940a2a6dabe7727a5a8f7c7c6cf0d9a7b882d14e79bceab5d5f859e35fb0a15d1dc9f1eab7784ad3b

Download Submit