4858cc5025b20959b1ecd8277433dc171cdcd19ca3dbe5cc9e90606cd3e614f9

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c2540f4ed94aec0aa1a9f561e52e30N.exe
Size

49KB
MD5

f5c2540f4ed94aec0aa1a9f561e52e30
SHA1

86439d8ebdf1756928f88f953630d3f9259f444b
SHA256

4858cc5025b20959b1ecd8277433dc171cdcd19ca3dbe5cc9e90606cd3e614f9
SHA512

ae763835ca5c5943fa953485636e9a2c7668147a7aaa1f4c05d17bcfb020498386a439b73c3e3629f70cf5c7b12edda11cd81c2c7ac233ffabef0c1245806fee
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIw:W7BlphA7pARFbhL801VvM801Vvv7cYy

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4518) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	f5c2540f4ed94aec0aa1a9f561e52e30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5c2540f4ed94aec0aa1a9f561e52e30N.exe

C:\Users\Admin\AppData\Local\Temp\f5c2540f4ed94aec0aa1a9f561e52e30N.exe
"C:\Users\Admin\AppData\Local\Temp\f5c2540f4ed94aec0aa1a9f561e52e30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3264,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
49KB

MD5
e3d3b99299b6526e508138ecf999a20b

SHA1
d3de39334f32c81c53949680b801167f99de8ea7

SHA256
827e351c5cf2e6902ff3b5d5fff60762560c5a6fdbfad1fd5d60641b73fdf8ef

SHA512
af3736dfc0b3a88861a1be841dc3b3f4c928e41b78719eb35a0f5bb77bbe5f0ce6c90672d0ab4466f7ea0f757cca15322327f982132e4248ff95dfef5a638e2c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
162KB

MD5
50b87050a326935fa3e94af4d7efc6ac

SHA1
43c42a0839dfb50f3d7a1a9db607f3d58105bf1e

SHA256
326df602452167659cdf2d9e9f9d803b45c2815d0daed60dc20888454f3557da

SHA512
56481eab3e1881d4072a99df6fb22f7bd59f9dfac05cdaf6aaab5ac82bf59a4ed6b60849f550cce9f935c1370bf3256c06a217e102c137cb901fbc99e25e19a6

Download Submit