250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
Size

50KB
MD5

d61a4dc5b04d133ba3a8ea1e6651c9a7
SHA1

debfd036ae5ac77d1d5c5bbbdfb98ffd194a22dd
SHA256

250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61
SHA512

ab2a4bb05abcc5f84c7114670094bcd22e6dc81cc7600c4a9eadf589d2bae9d10ef66888dfaae32552cee3d47bf7c9f1e09c8b1e336758abba60dc2016403094
SSDEEP

384:yBs7Br5xjL8AgA71FbhvBfepj3cfepj3KtLJr4S04SCzwz+5zz+ozz+i:/7BlpQpARFbhq1KX101GIW/+o/+i

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5014) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ms.pak.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe

C:\Users\Admin\AppData\Local\Temp\250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe
"C:\Users\Admin\AppData\Local\Temp\250356eedbffacce1e1d097afedda083501bbe420d20df11c95cf6c001599f61.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4508,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:8
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
51KB

MD5
bb0bc6fe6c221f6d731135316d2ba894

SHA1
80f5d60b41739ef867f892284542a6cb92c9134d

SHA256
f82d629d7077e57e589c63866d6a5ff436ea767dad233c1c2bc8846f097c7f59

SHA512
bea5d800b7ce6fdb6e524d624ee4e9840118f61d3de4a1b81797499752c973caee03e88f3e50031ba88e458559a735647f4488db5d643bcac84972091458cbc0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
163KB

MD5
564c3d1e8c5feebae8fcbf79b6151945

SHA1
1b14b2af1321061d6d624d4a8d410bdc1e99b860

SHA256
a8f29dc0ee0cc08bad4c46123617bf1157acd0a442796e7d1891fcbdb243b668

SHA512
e6d57b583ae0f9d2413970bdcf28e559ab057920981f91cafeb5b5758262e7643de2cdfa4fe58d3a85a35b4569ec0057ef51fc255e1fc9a4c556ad03322ca9f4

Download Submit
memory/3864-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3864-1798-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download