394c49a724afc446560c5cf02967da171d6ea9316515f1da38a9aabe7ebaf030

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c311a479232dd50bc883578c48c06b0N.exe
Size

90KB
MD5

2c311a479232dd50bc883578c48c06b0
SHA1

f66649fb649ae8f55660d26345c6e1e4561800fa
SHA256

394c49a724afc446560c5cf02967da171d6ea9316515f1da38a9aabe7ebaf030
SHA512

e19558c63b39c76679b904011acd7fda21f1463faa1db911037a77cd55a70038ca40e4f29489c9dfc99e7df8fdcf3235fbefeb7b88223c5bb0328bfca20479ba
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhB:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	2c311a479232dd50bc883578c48c06b0N.exe
File created	C:\Program Files\GetSplit.pps.tmp	2c311a479232dd50bc883578c48c06b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c311a479232dd50bc883578c48c06b0N.exe

C:\Users\Admin\AppData\Local\Temp\2c311a479232dd50bc883578c48c06b0N.exe
"C:\Users\Admin\AppData\Local\Temp\2c311a479232dd50bc883578c48c06b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
91KB

MD5
c11e3df4e15312804c48a6a4e0bf0d00

SHA1
553b5c1cd55b6b2e2a796a2425ae6b5f6a883b4f

SHA256
f4aeadf1d1661489ea66f829e1094fd5202923b2d3f1daaac80051c30d3a9035

SHA512
17431d833c4b37ed3a17f45aa5485196cc57ecdcbf63c10207b717fd5c9e2ef027b4b48cf6f35e275c372621ebf0d4ed518b2389b6c7b79c9782621e95a97700

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
1a854c5575b91ec66beb43c9c56fd8a8

SHA1
e485bc4d2f10b22df2f7ffef562bab75fc9542e9

SHA256
4865e54526b434e1ddcd92ce3018e5cc733c7a06b9e4fdd22c375be84df02e0f

SHA512
44d026075f12d04c2d8cebb3298c0dc4516023f396d930c265b9ae64deb3f6ff9212416a7fa6469e7bf609b16a47914b65e4e5fb5126944672f65bf684538df9

Download Submit