86a76e2c45b985b9a717729fc3fe995bf52cc7eece36235faf2da434192f677d

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b83d0ef62f3a715c0708465a81d0300N.exe
Size

88KB
MD5

7b83d0ef62f3a715c0708465a81d0300
SHA1

a4bc07252ff28d64df890bfdfe34cfec30d957aa
SHA256

86a76e2c45b985b9a717729fc3fe995bf52cc7eece36235faf2da434192f677d
SHA512

9b7a1b4b3491f9fb6c06baa843b37c5336fd2e013805f5acf2f2ca6f40facd50abbf4145f549809a4a533ac029493d94342e6a1c32e79e3fdd803291fe4a920e
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggyaRjvmujvmRzqzlmJgwmJg/Svqz:6e7WpHIyRF9ESWu0SWuDm841q3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	7b83d0ef62f3a715c0708465a81d0300N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b83d0ef62f3a715c0708465a81d0300N.exe

C:\Users\Admin\AppData\Local\Temp\7b83d0ef62f3a715c0708465a81d0300N.exe
"C:\Users\Admin\AppData\Local\Temp\7b83d0ef62f3a715c0708465a81d0300N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
88KB

MD5
3119e92090d4d4f37ab165fe4e5a857b

SHA1
e4c0d4a4ddf02952f94d0d9ecb720c92e87ca869

SHA256
ed3c408e68b36543d2d7996659f6933163ff163757b66ea22c9354a1799ef344

SHA512
6fa673d67e8649c966234bfe8c95cf5ec6f7fbd80f698a3a957e41f5884675df8f2a75ab57b9cabad39134ac655cd23b6aa27708699c85814da3e00b00523c57

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
187KB

MD5
3456a3384b7f575f7f80881a3165221a

SHA1
3ec5fcd3db9e37a1f6e06ba7219363bdbe9d6117

SHA256
9c74f4149590ff7889cba74b17b2b8edc6151969a644aa449a0c9e4e1f8c4b0a

SHA512
4208db80e5bde14ead4420396296a0ac73ed04dda364f85129d29045ed099fd4664f1515d4c869ca5f8c1b1c3f3e4c856536721ceb60ff659624372daae14b9d

Download Submit