5d7c600729a97db40def4c4d0b3767767b2599ee5e14f09f8194ab7e5719b6db

Analysis

max time kernel
119s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bfe598bdb3f00337d565e368f43f370N.exe
Size

45KB
MD5

4bfe598bdb3f00337d565e368f43f370
SHA1

e998eb9ebcb3bc94fb702153ef42a89c4fe88b50
SHA256

5d7c600729a97db40def4c4d0b3767767b2599ee5e14f09f8194ab7e5719b6db
SHA512

5ce77d932e8fd99e429bb45d7b26bcd00da8a4e060155ec7154a88da7f80bce0539f0a1662e4e5e3d423f163ef0f3cab99d40a4de2370631db54a1c12537f612
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJcUYU+VD6NVD6X:W7ZppApkxUYU+VD6NVD6X

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	4bfe598bdb3f00337d565e368f43f370N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	4bfe598bdb3f00337d565e368f43f370N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bfe598bdb3f00337d565e368f43f370N.exe

C:\Users\Admin\AppData\Local\Temp\4bfe598bdb3f00337d565e368f43f370N.exe
"C:\Users\Admin\AppData\Local\Temp\4bfe598bdb3f00337d565e368f43f370N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
45KB

MD5
02e6f92a956655208f5baf28d7f977bd

SHA1
760842949584af084f99a5cfa6ea6e04a4e8d1f5

SHA256
4c2988a471b7b95c6113d850ca552bba98effa209be6a09c270c20fdc8d362f1

SHA512
a2d0ceac86fc599fa49604d4437903fd72abd4ae19308aed17bfef2fca690d0190145d07343c0941574f0ffea808bac926e436dc657973af707b6fd127992872

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
855481bcbf475c76f9b2182c3fcc5de9

SHA1
751c3e2cae15620ca4222e49ab8f68205f27f7b3

SHA256
ee7db68dc58d62ce280c98562887dd804fdba89d1934af3f6e407ec20de5cdab

SHA512
f200dd64a16c047948c25abc63f54a84eb021d3ea6377385ae68dc1e938c3054559f82edabd64982d842479e25f3cdb317ff8a1baa4805d9dec6a6fab002480c

Download Submit