4cfe9306dd61544bd50bbdc78cf6ffc29e4c1b95b7bb5bb6cecbdab3cd1890a3

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d7b17eae4f155b4e9219c5b629f1f70N.exe
Size

41KB
MD5

8d7b17eae4f155b4e9219c5b629f1f70
SHA1

ce730eb1b6aee2d434556265ea83e49399b90e00
SHA256

4cfe9306dd61544bd50bbdc78cf6ffc29e4c1b95b7bb5bb6cecbdab3cd1890a3
SHA512

f3685f148a9cadb8afbe7d5da9681890b3d2a3c44f68eca4791b11fb5cdb62ad9a8e8836e8ee31df704fb3ce79c8a2e8f7e21bb7a4389b372c9e27c3310cd249
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJsSZGk:W7ZppApkFS1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\mojo_core.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	8d7b17eae4f155b4e9219c5b629f1f70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d7b17eae4f155b4e9219c5b629f1f70N.exe

C:\Users\Admin\AppData\Local\Temp\8d7b17eae4f155b4e9219c5b629f1f70N.exe
"C:\Users\Admin\AppData\Local\Temp\8d7b17eae4f155b4e9219c5b629f1f70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-113082768-653872390-2867000172-1000\desktop.ini.tmp

Filesize
41KB

MD5
6b2ae7aad3c666a7f9a7016be8c92eeb

SHA1
dcda05d0e9de5901599de737ae0e0c3cd254b35a

SHA256
9448b835d61451f769e227275d8e9dd59bd334fe927a3af868a15f805bbf1e45

SHA512
dcf66bcf5f1558c91032f3b44680f2db65297f5a82504efae86b7a0d8c1052b10cbfbe30e5521e39f8e43d0ace5cd504e7d395606b20a9a5719a78760801439d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
fe106527c1ac1ce91ad41e9d78962fc5

SHA1
5261df45aa35a3d575c402feef0ed4773e4913c5

SHA256
cd2fa6db23ee7aaba75406eaf7bed124afb32a2bff4fd4de8ead0ffc7475a3c9

SHA512
c3b3a8caec42dcdec306caa46d7e52a45e5d686d26a1ee18b4e95d9fb429715d6b5f47c8c7b27b4cbca10e71f5709f7be97d5357dedff090d9da82e4547ac414

Download Submit