0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
Size

92KB
MD5

f346a255ddec36c3a00ee8f1779ec6e5
SHA1

c610227aaa9ef5dc08a05d8d54c8b5c5316a5935
SHA256

0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d
SHA512

f51b06d81f04a6a268fe114c53da3a5986cdbe2568e660ed26b939c367ed329e2d35d5b87f075bd15c2fb58b7589dd688b2d68f74f5ffdc7f882fd7a3a51992a
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYKQ:6e7WpMaxeb0CYJ97lEYNR73e+eGGu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5114) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\BlockEnable.ods.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VCRUNTIME140_APP.DLL.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe

C:\Users\Admin\AppData\Local\Temp\0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe
"C:\Users\Admin\AppData\Local\Temp\0c76bca2aed78eadb4e10d67bb17acea1923264a9a579e0b9dddc4a4bd15371d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
93KB

MD5
7100e28eab6be3df5c0684139bb634d9

SHA1
5134276a91bb408b5b4ae2ee33947fe43a9f4485

SHA256
9da813ef984871314ac904a04e8d6d6e24dbfe3f08c1b1495564c63b6fece7ce

SHA512
3bcb7011445a27352173fb06147cbdd1582ae7ef5e0b6efd2ef8cb0166ddd1859efdfd8367fa283447b37b638108aaa28eac703c8c07c90d953b0957152a2bb6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
192KB

MD5
ee98050c90ff1b6281038e32eecfb2e4

SHA1
0ce56db5b0af3ad160dbedb8b1a6cdc3f1bc6a3e

SHA256
e5903e425aae6eb016274d889e69ba7d90ce58c67cdeb02e53584ca3be3cdec4

SHA512
d3fc1f8ca65d534e2764ca8ebdd205beac89cb559ed570afcd720c21d2451352b971b51a68e4bf1c78596a078dc9393b5522afb4799c93b60d99692254126e7c

Download Submit