134aeeea038b401cdecec14a9d80326ea886d3a624eb79348cefd04e21bf4516

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25c856a1b3b301e66d11b98225fbda20N.exe
Size

104KB
MD5

25c856a1b3b301e66d11b98225fbda20
SHA1

c9e7eab14c3d56a54b1b85b970b90a979b156ab0
SHA256

134aeeea038b401cdecec14a9d80326ea886d3a624eb79348cefd04e21bf4516
SHA512

fd4a75d95590510f6fe7b9e9440e33bcb7ee197d9d76d9d512722d4b1a6f67bef84398edf7aefe3ba9f0e7e0da1473bb1522dd5cfdccead66176aca32dbe7691
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBM:PqFF2Ie+efsim2n

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4362) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	25c856a1b3b301e66d11b98225fbda20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25c856a1b3b301e66d11b98225fbda20N.exe

C:\Users\Admin\AppData\Local\Temp\25c856a1b3b301e66d11b98225fbda20N.exe
"C:\Users\Admin\AppData\Local\Temp\25c856a1b3b301e66d11b98225fbda20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
104KB

MD5
7daf68e5ade5e68891c5d0ce935d4722

SHA1
6c895baac05387c361dd3805c5fd900594e13a6f

SHA256
a0967b9a288e91672611b72851d62427fdfdf75b2e4bcffebd844f56eb976502

SHA512
0993e57174255b49eeac1eae7daccef19c11d731aa8780599b36341ce302b59e38e4f5a7144f4476372bed7b65f5b34fc0480881996df764815756633709fddf

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
203KB

MD5
a4c1ec354c90954346e0a4e720095eb0

SHA1
2e736620c2724f529bed1e9fcaf9189108dbb418

SHA256
c5b16c391bbc83e0f45d963a5a7629aa204111c3abe0aa849e4e74c5c4ac2303

SHA512
be89dd61a68ec4a762994584f6d5c02488f6b98b9ea5cfbabebb6288d7812e3fcf53ce4dce7fd2430af533870afc6eeb7961bae56efcd1773948f8356cafe64b

Download Submit