bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
Size

42KB
MD5

84e7cb764ccdcedfbba9230deed896b1
SHA1

ce5b8c638d16f67a0b7682eae6af69203790af72
SHA256

bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc
SHA512

e5fa0b54cf4e4677b519b96c0530064dd28872469376cb8cf861f1e905ae29a2ef8422ad3b342ee72aebafbd6ade76455fb52a7e2eab6aff63f8cf07d8186130
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvn+nDm0CAmmLg5Ms7spsZ8HYGkqvtJ+Jo/YdUdg:W7BlphA7pARFbhOm0CAbLg+so/YSi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\TEMPSITC.TTF.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe

C:\Users\Admin\AppData\Local\Temp\bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe
"C:\Users\Admin\AppData\Local\Temp\bd47f5835e02d9041bdd585df0e12b0165e0f0ceb416cfa734c87b9f5421a3bc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
42KB

MD5
f3ce3c66512991a5e37e456e1b30979f

SHA1
619e38d8582dc162e88bb70048c70b36bb543058

SHA256
62eb02a698031599961f13b7a12bb639ac601c6c6ef017abebbf9c67b0c7c9f1

SHA512
c2c6d17080463ba1e8113c7c253069eb877c462775d70cdf54c9f2f500fa515b491ff3ebd06d6b48564bf959c945d832fff2429aecfe53b1db482cad11beea56

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
e77ac02314effcb6ddae7c7d3f1f9e2c

SHA1
3973b9472ede3e706827b74e2e9fcf8170c0ac8f

SHA256
bbef38559bef1f73358856a238d607a0570b33266fe59d0f3872a80901cc1ec0

SHA512
4407ee2dbcb0ebfb5d7a72004e54b34a1a748687679dd6472757748bfa0c0016857153abce8712ecbf11340476d4d5282b4487de1a9b63dfcd17c8cf02a44eb6

Download Submit