48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
Size

52KB
MD5

48fc8d1f6b5830cecce3f4bb4fc20bfa
SHA1

11c892f78d90fbcc0dc1bd31c0eff4187e2910d9
SHA256

48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431
SHA512

fe06306a57ad8bd53ad678d5cddb8ec3d9dfc0db4484a068550dc014f381e93a5952e574a917862a65ff2fc57516607f6e76e2a97987aff63a006e35405ac7e0
SSDEEP

768:/7BlpQpARFbhfyiyooa0OMiJfoa0OMiJ+PQT8Yi1xKT8Yi1xM:/7ZQpApHzoPQYGYQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHIC.TTF.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe

C:\Users\Admin\AppData\Local\Temp\48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe
"C:\Users\Admin\AppData\Local\Temp\48b11c223e18db09026763ae533147844e0832aa115926cc233cd69ded3fe431.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
52KB

MD5
3151b561834b6821737f47c73ee02c8f

SHA1
2aba622328c4b3d73b298eb73e5af577483c08e9

SHA256
78aad2680028281da7d41967ee5ed2bd20fa7ab3c1520e3f98d6b2733adad6b4

SHA512
d1882fd2c63399622ab6d8ade89d25ec78a588e74c13cfca5fef3cfe854967e331e8a6de1199ed29270b95cb881647bffbe119ffb65ae3e8d290096bfeb6a46a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
2db6b6d5ab7c33223bdc1533c8c35c3d

SHA1
5e1b20312675e6bff8e842204bdbff356a5bf7ab

SHA256
9a9c011b43524c07227484bf1b65440b9f7c827ca711c132ac9e1b1e60012b6e

SHA512
95457f93c95f9ff43d3fa891bb2fa66cb9f9c2bfff8f5ff4e876c64d8ff84ba193867205e579c00b1d2f70a94db25758699feeff371b9d93f8b2ae4e9449483c

Download Submit
memory/4672-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4672-1980-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download