78dbd751a39410811ada32f516a9b50e12f7c8f411722685ccc4db4f77b26c93

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28ec030677e03133d96e6c1fddb4dc30N.exe
Size

83KB
MD5

28ec030677e03133d96e6c1fddb4dc30
SHA1

82d41d25b1e32abe986ffa76e305da893fab6fd5
SHA256

78dbd751a39410811ada32f516a9b50e12f7c8f411722685ccc4db4f77b26c93
SHA512

f55596e8f66b1f8615ec385818e2bed7e2b0335c3cd7b5483db7e187c6670a98266605dcd074fa158ae2bc957f36a304af7eb4be2bbfdaafe564be55aba14c7f
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd5GT6SsDCpiapij:6+WpDfmRfmh2TSDeimij

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogo.png.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\es.pak.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\d3dcompiler_47.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	28ec030677e03133d96e6c1fddb4dc30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28ec030677e03133d96e6c1fddb4dc30N.exe

C:\Users\Admin\AppData\Local\Temp\28ec030677e03133d96e6c1fddb4dc30N.exe
"C:\Users\Admin\AppData\Local\Temp\28ec030677e03133d96e6c1fddb4dc30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2927035347-1736702767-189270196-1000\desktop.ini.tmp

Filesize
83KB

MD5
6b0382d8feb1f5d286827b9964f84495

SHA1
6833b487d3310de87e93eff0d1800a818bad5333

SHA256
c9527f01787ded65d066c551c5a2e0fcb16fd0dc039497e6680e26e83a9cf0a5

SHA512
c73008828bec731e5effb7cb42d4a9fc29afdef649759b40ba9e84d12d6385a022b6a2a0f8383dd15ef8641aa2bc886decabe89061e4bab7ababaf887abc76ac

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
d12e15d7f647ab2a60808b6ad12c1383

SHA1
13fe13411b2c29ff964d7ff9029cab1984455bbe

SHA256
30f064cd2a58c2c5f97adee7f86fc68041cdff059da4f234a5b4fd496af91363

SHA512
a70b2787bc2cc2536efa5ae320c524d828ca6e68b1abb3262f55ea263e897076af0f616d4993e3b16a60f9f28e483afd1680689db3ddc97a39221662344e42c7

Download Submit