dafba00033eaa93371b992a40d992ee2b732b86f8a76a16f06b7fa0d149fb9ef

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
Size

68KB
MD5

10b0e6c0dbf1cc72c4f9abece2e2f650
SHA1

0cdc3c4923ac1c26f06e8d9f629a568886d240a4
SHA256

dafba00033eaa93371b992a40d992ee2b732b86f8a76a16f06b7fa0d149fb9ef
SHA512

df9b87b4227169eb566a8397565dfa1aaacd129053dd44afe75849d3ddc4180266cf1c53f2710d17928fa30f9a8fe7efbb2b353eecbee338dc05c88c7552fd58
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJaMGw4PCs2B24PCs2BHE4JAIAepEK:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4391) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\FindGroup.vdx.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoBeta.png.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10b0e6c0dbf1cc72c4f9abece2e2f650N.exe

C:\Users\Admin\AppData\Local\Temp\10b0e6c0dbf1cc72c4f9abece2e2f650N.exe
"C:\Users\Admin\AppData\Local\Temp\10b0e6c0dbf1cc72c4f9abece2e2f650N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
69KB

MD5
807194e19cec955bec1d34ef2275c5d6

SHA1
e978c20f3baac1d7763c4efe3af024315357eb20

SHA256
91de33d571d07e629f3d3805847c3a160756ea720299c6145f1440dfbb13462d

SHA512
799e584e4df265e5676837f5cf9b765af6e33561acc9bb24bd7b9af5e79fbf59ea7686c2c150e48800744d28e8c52d1360be5bb08950e2e1939a7f021ec6f549

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
8100c168d4a899a255f81427382ba2b7

SHA1
6fa3cfd4ea91d066445a19c329b39fc1f165bfba

SHA256
2fcae9384600e99121acd91de610b5591bef435bc2d680e9a52dc43e4d2c2615

SHA512
5a9b38d626674e9181d22299b38937a19381b41955d5f518558591760463fc78799ec80be42931485ec59756598dbcbfd174e65dd935af461999ffc135c052bc

Download Submit