20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
Size

99KB
MD5

bfbd799563dc6349e1f831c7e08f55fd
SHA1

956ecd75a95be56a08962c06273ea8bc490a0d5d
SHA256

20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a
SHA512

893bc0a1ee17182b063fdb06a5eee1ce2f9480f928d0ec6f07c380d0c5c5e2dcdf5279cecc66e2656f6c56b56f1a587f29fb72459c247eda1b3d80aa31c6912f
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp+ESIXosbosI:6e7WpHIyRF9ESWu0SWuDmmSIjXI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5010) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ja.pak.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe

C:\Users\Admin\AppData\Local\Temp\20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe
"C:\Users\Admin\AppData\Local\Temp\20834cc54edd9230b3a401c7c0b3d1932fb6eac16de4450694da40d5ee6cdb1a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
99KB

MD5
96dcbe00fb9da9e1975c9dd2bc9f2a58

SHA1
5a8f41a844884b962994f3c7c27b19fcfb1d9e3c

SHA256
d0c1e861c0c4b8b0404048949b0243d182a07af1831c37586d85c4fc8eb260b3

SHA512
898d7f5f690a3a0805392b38a08eb1f6eed8cc248c5c4feffbc942fc0c97ca22f80783ddac2e269e9cf149899ff598e0f3809580d95fb91376e940d30fae2585

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
198KB

MD5
72b02910cd2e50200109b96589e77caf

SHA1
82ae77bbb681be8a067692614d0ac9cff3fb18e0

SHA256
c97eb9594d61747eaf2a6e816876f7beaca0e400a70ca1cd843e01b107210438

SHA512
f49e5cd0520790e72ee485285449694b8f89d67d5293eba7ccb7689aff636a0ee625f267fc10bfd8c31c62bcc7f36bb0501976eb3b957d4763adc9b930d7baa3

Download Submit