41a59669ff9b1346d08fe57494fa23c68d02b446d0d78f406d2438badbb4b573

Analysis

max time kernel
118s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd4af74e15862253c01973affabb72a0N.exe
Size

82KB
MD5

bd4af74e15862253c01973affabb72a0
SHA1

54ce17a44e99f70d279f156ab2f03fef10312813
SHA256

41a59669ff9b1346d08fe57494fa23c68d02b446d0d78f406d2438badbb4b573
SHA512

082a0b279b79fb4ad95d1066c62392b2b04abcd1deecdd2bbdc5166e7310c46a5801d55f205d78c17685dde1e48f99c2cc9bc3884e9057bae69a3aec02ff73d8
SSDEEP

768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmh1444REXBwzEXx:W7ZDpApYbWjIoPyPoLzV7c6Sh1XH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	bd4af74e15862253c01973affabb72a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd4af74e15862253c01973affabb72a0N.exe

C:\Users\Admin\AppData\Local\Temp\bd4af74e15862253c01973affabb72a0N.exe
"C:\Users\Admin\AppData\Local\Temp\bd4af74e15862253c01973affabb72a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
82KB

MD5
3f33964dc3e4f4de976be5d6a39ceb27

SHA1
1a27b36c26a8bf6149528d247fdece364ce063bc

SHA256
4305a45c0202211081eedf7029fcaa71b2e6f92be0014c7470084d4bdc421339

SHA512
91f35084c1b0ad571172c9717d152c1e0c55595bed27033eb67b0494f97c22531831e824036e4d0a9d865df2c6b86478c4e0c80e559d47e7059eb1b0832c3bb5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
181KB

MD5
26999f5896f793f677300cb3d8fbe61c

SHA1
de7ad3cb999e255f0d3d552a00364452c5bc9ff8

SHA256
b51692e1125903345740cc5ea3dccb794504a4657e85c2b70225fca224c9ae78

SHA512
5e53d4938a5d45a6ce4f66e37cdd32761e066f044393b8f25768d486cf99fa39f540b29fcebde1bce410e6bc9468b8c71e653bfa210363cc8400c198f3684ea7

Download Submit