30c724831ca9c4afff131a7c400546036a51b5eeb5b7b2c445e259ffc424f581

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16b45b45007bee220d4d10bdb2c4c970N.exe
Size

45KB
MD5

16b45b45007bee220d4d10bdb2c4c970
SHA1

9b7869b9a8de788645ee446687d205db92755273
SHA256

30c724831ca9c4afff131a7c400546036a51b5eeb5b7b2c445e259ffc424f581
SHA512

40fa6a5dcddc107c471df51d0c0f6931ba933dd5645ce0b7a1f37d6d14286ef1773a9cea132437bcd7e33c31c6e9885eecbeed01a6e972463856dbe7e6df4520
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaI7:W7BlphA7pARFbhL801VvM801Vvv7GqS+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	16b45b45007bee220d4d10bdb2c4c970N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16b45b45007bee220d4d10bdb2c4c970N.exe

C:\Users\Admin\AppData\Local\Temp\16b45b45007bee220d4d10bdb2c4c970N.exe
"C:\Users\Admin\AppData\Local\Temp\16b45b45007bee220d4d10bdb2c4c970N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
45KB

MD5
b178b1eb92002fc8f8d75e502d71cf1d

SHA1
6badcfb7a849956c409f0a35b606866b346104c5

SHA256
762cbbe17a7c777ef12671fbb2479ccd84a69b78bb976e00bd4cb5a111fcb9dc

SHA512
040d2a48ead121989e1d2718a5d19242fa6d89a38413745deff10bf7d8a5b326a0ebfca08285c8e956e0a1c289469af292dfd6a9e1ba05ddb1a040d47fb7f153

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
41bac5edb7358b0574945ad7d65d427f

SHA1
b790ca49bdfc4ecb5bf41f04a47f1d0bbd457dc3

SHA256
a0fd24729a3f3d398c9a46600525c761ceadd2e97f8b535c09bb6ba941ac85c4

SHA512
c34d3c65eac6ac9131e995c62c4e3976ec27a04578afe56adb2fba315e9f08f5764e615ff95c7974ee541040d876b19b92818c783f9e08c39346c2c3601b3048

Download Submit