1ea19b07d2ea9469b7ecc24d29e1febdd3d6d55adea32d9632a5c4ec16324585

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9b2c15f64c4500dd9980518433dea0N.exe
Size

45KB
MD5

bf9b2c15f64c4500dd9980518433dea0
SHA1

af48a611207db23483750185bc22ba1d23836478
SHA256

1ea19b07d2ea9469b7ecc24d29e1febdd3d6d55adea32d9632a5c4ec16324585
SHA512

a5cf20da3d2c66d0ad6734d5e5d85cf533928f01981f6e6f371465fdc8ffb1df97e4c82421c693ace51f437bdec81f632182ba9a0f6e3a7d71ad018731fec04c
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0k6ol9OiJfol9OiJY:W7ZppApkGp4G+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4535) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	bf9b2c15f64c4500dd9980518433dea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf9b2c15f64c4500dd9980518433dea0N.exe

C:\Users\Admin\AppData\Local\Temp\bf9b2c15f64c4500dd9980518433dea0N.exe
"C:\Users\Admin\AppData\Local\Temp\bf9b2c15f64c4500dd9980518433dea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
45KB

MD5
17bab910afc06156ff74d17d24e0be56

SHA1
53a45b67628e0c88a803caa8a9e2e00874d2cdc6

SHA256
7e9afaeb20d3d84411faff43b844becd783b5ff4499cd80bf74a0fc8fe6ca06f

SHA512
ecc77031ee5a7c19b1373bed3de7e6b3f1cce244bbd64da951c4ea9443020ba3fd389f84f6d0af8c15e87815075e54709b5de22ae2543f76c8a037e1ef100c11

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
157KB

MD5
9e135479144b110bbef7ef6e463b1d38

SHA1
e1af320c897fad9bbb46ad9cfe87b51722daa450

SHA256
842ab3521230e2505c1632022f10c7ff39150e23296a80606b1f85c91bccc4b8

SHA512
3016fd5d6cda833699e30c2d645a5f0ab259a31b0171d82ce1759f2edea3f53b5f628f0edfcc80f4fe158a06af02a68ae25040a3833288b894e16cc3f0ccbac2

Download Submit