eeb2e667118b8967e59551d1ab2491fc0f136a6e5af4353055e7b47058118da0

Analysis

max time kernel
120s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b01116ac44f622587fc5e8a28b911f0N.exe
Size

53KB
MD5

1b01116ac44f622587fc5e8a28b911f0
SHA1

19e1c8cfd1db0447030b4ab046814434bfcac4de
SHA256

eeb2e667118b8967e59551d1ab2491fc0f136a6e5af4353055e7b47058118da0
SHA512

65b0856093a62bbc2d70e9f063b5a67c24583c94890eae1195d74edc749b6da1860f12d6b266c14293f2f4023775c389c25df6781e557f4ae2e8e13f1dea1a6a
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvyu7uGYSinVtYSinVwb1W3WAuO:W7BlphA7pARFbhpYSiHYSiZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\v8_context_snapshot.bin.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\ApproveConvert.pptm.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	1b01116ac44f622587fc5e8a28b911f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b01116ac44f622587fc5e8a28b911f0N.exe

C:\Users\Admin\AppData\Local\Temp\1b01116ac44f622587fc5e8a28b911f0N.exe
"C:\Users\Admin\AppData\Local\Temp\1b01116ac44f622587fc5e8a28b911f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
54KB

MD5
3e5ab84411a39070fe61603ba6b82eef

SHA1
744bc19f29a840759f0e5b1c14179d8e3878b1a8

SHA256
fb934032e159b5ca34267ece1cad55e5380540e903196259ed76f80b73f09016

SHA512
c20a986317bb181b21fe86cda698b9a9e91363fb2d2c985b5ca85a2e839b9dd3ae0302d9b6d5c400163c26be8cabb4c7b80e1ffcfbe812c7b90072e532da17f3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
be1837833bb0ac58b7720cc575802bae

SHA1
42f35ca62faebf204c65b32ebe27a0141be8f633

SHA256
62e9c414ceb04bba0d292f5b90db9d5c5e27cf54e17c8756c9df61c1ecaac166

SHA512
b98fd283700e7f129ae0d03cd7544bc18deb252ec4063805f2bcbd47d0fa133d449528635209238730c98bb150925c3afb950aee7b826d730851bed3227d29f0

Download Submit