44139eb0da8cba7d44bd31b73f29bf70e9c765fd012baaa61ae5f3061b76fdcb

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b08b297f8f24127558d504915831ac0N.exe
Size

37KB
MD5

2b08b297f8f24127558d504915831ac0
SHA1

9748d1dd0096062b4e2e675551982dd20e274618
SHA256

44139eb0da8cba7d44bd31b73f29bf70e9c765fd012baaa61ae5f3061b76fdcb
SHA512

b305dbb3a8eb08548737a768c5b15b7ce7a81db0f01d42df25a6a526206cd8392503168dffe4c67ad72cab2a211505a8d0a84fe3281b790ed08287ccc59f408c
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJH6vBSSvBS1rQ3nWrQ3h:yBs7Br5xjL8AgA71Fbhvx/ivK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\da.pak.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	2b08b297f8f24127558d504915831ac0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	2b08b297f8f24127558d504915831ac0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b08b297f8f24127558d504915831ac0N.exe

C:\Users\Admin\AppData\Local\Temp\2b08b297f8f24127558d504915831ac0N.exe
"C:\Users\Admin\AppData\Local\Temp\2b08b297f8f24127558d504915831ac0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
37KB

MD5
8a656efc2d8179d16c19a5dda4c3ee51

SHA1
b9b4ad21c218f85202619624dcb1153277e251c8

SHA256
f2b23d3e944ecac8a816031d44e18578ee7017f36deccd9dc1ffe1e86a50a5ab

SHA512
d10a8c6038f81faa817bfa53ea70a1fae4e97dbec334d5d96d63d5a797a5c7a64b5edafabf942d6cee7270efbc44298995350c418c234f04d3953c0c375102de

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
3bf45177538d28bd556ebc56e5d33b93

SHA1
9a59c22fadc80cfb219d5dc1e648023bb4d25063

SHA256
1da4ef2c687bf00d76e50120964c1d897d010051407b0295774201c444bc0c94

SHA512
8d4e82474731bfc4b767faa0637640524a3569b0a9b54b8f3888d77e1a249d9cd3d0f4b411a4105c7f72ffd1a3881e874cd1f905330b187a8f762a2ef6744b4f

Download Submit
memory/1920-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-1959-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download