47bbbb8d82209ecfdc78750a14ce3d2b414016a507e337933994548287bc9311

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

546e8e8aa4d6f5536e5a3363ff33f860N.exe
Size

41KB
MD5

546e8e8aa4d6f5536e5a3363ff33f860
SHA1

9ce64422ae2dee8d3c413599f4cda7a285e2cc69
SHA256

47bbbb8d82209ecfdc78750a14ce3d2b414016a507e337933994548287bc9311
SHA512

8dc056ca42d8e3184a20e98efde7d439ffc66e234c62152198cde8ec1140f0326aa78492d9686d71fd885acc7f7570d80a1b043072e9794e1b049af5a92f2751
SSDEEP

384:GBt7Br5xjLvassAgA71FbhvYD/DggNNHpQKMNHpQKMFwWnm:W7Blp2sspARFbhVgNNHpQRNHpQRO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	546e8e8aa4d6f5536e5a3363ff33f860N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	546e8e8aa4d6f5536e5a3363ff33f860N.exe

C:\Users\Admin\AppData\Local\Temp\546e8e8aa4d6f5536e5a3363ff33f860N.exe
"C:\Users\Admin\AppData\Local\Temp\546e8e8aa4d6f5536e5a3363ff33f860N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
41KB

MD5
63e6d653b225587e9c9e3648eb1703db

SHA1
7eb248e48dfd1958a64e7ed20b52a80ce87c2671

SHA256
d5baa1f4c97b0d7bc577f3ff4422c293760a34d1ce7423d4d7f1b7a7726def63

SHA512
1faa8af246b0396f0a08fa46bc58cb6287c8dd5d871604fab2b62844bc685cf90ef9568058f88a39367622860bc97c6d7cd9f0f276c9a3900665cdd555e32630

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
bf9aff20d21e33c86a873f5bdfb6952f

SHA1
865278a89c4b46649cc5c29ad2266b4f7a6ac90a

SHA256
8bf14bae57174a9f1aa30c562a9e3a976a995179af0456cef5bd15164970ef66

SHA512
2def674797cceef7740cb8be9e5b42e4a6e63c7ef495d9baccab1df9f7bd0537d89f95c645d340dccfa9e53ad4630fe40622250e1b3f1c378df69e3fb94c3d60

Download Submit