a40e81519b2f8e7e0bf84937121b0df4e0bcaf9fa150eefc800d6d4af921422e

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9aae6c1ba03b79fe8af0a650e789fc0N.exe
Size

64KB
MD5

b9aae6c1ba03b79fe8af0a650e789fc0
SHA1

2754f8347cfab77a6a10eed44c7c111bc169c28c
SHA256

a40e81519b2f8e7e0bf84937121b0df4e0bcaf9fa150eefc800d6d4af921422e
SHA512

7ad4c9e592f4d98a3af81d3c8f6c1ba845c9f152ecde05a5150eb6adb1c8ac33e0c2f1b04004c8984adca34c92400eb83edead424c7ae13f9d650a40a6641e56
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/8O0Op:W7ZppApBULcfpHLcfpX2/Nw/Nwmxm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	b9aae6c1ba03b79fe8af0a650e789fc0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9aae6c1ba03b79fe8af0a650e789fc0N.exe

C:\Users\Admin\AppData\Local\Temp\b9aae6c1ba03b79fe8af0a650e789fc0N.exe
"C:\Users\Admin\AppData\Local\Temp\b9aae6c1ba03b79fe8af0a650e789fc0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
64KB

MD5
3b8bf7006a1c82ec6068c597e842201f

SHA1
92d33b5524c321998cea4e5869df3f86256075a6

SHA256
4b86a8464140350986a571d5b523b35e497000e3e4c11b7e137f74de8f447562

SHA512
91cbf947ec9609eb9bc757b585f59d61277a14bba5fd98fc87395a471b68d81a8369b61ef228908dcf4f11831866f5c798859c06e1eda55dfd9b051a27cca6c4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
163KB

MD5
2121b22283c32eb58b4e9a69794e5f2f

SHA1
b05f7126bc74adec790ec544683d2def225d1259

SHA256
af9223251789b1a9c50edf38e431e4231c69df5a4fdcd09291ab72a1d42e966b

SHA512
4281e638f08e6aed94070b91c68302b2bee4103263d97e7f5f722cdf91937b61f6473738f2dd9062f88cd59dffe7b2ec8049021fa9d86bae357a2e30e3873887

Download Submit