50504b056c6a8de9609e0f1a9a15b534d428137e86398c7e1bf4d9fd22f79b21

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87f89e841c0b69303bb5f5d8465dc670N.exe
Size

102KB
MD5

87f89e841c0b69303bb5f5d8465dc670
SHA1

b9a796dcef27e2d7803783f7c1658d07c674c7b5
SHA256

50504b056c6a8de9609e0f1a9a15b534d428137e86398c7e1bf4d9fd22f79b21
SHA512

258f4d495cc38426cfcaeb7d60406d58acacee4f09e385233f226b44f45bacbd7009547d47d1d211134144cba7bd827cde143acd1e26729b1338eda24d53e490
SSDEEP

3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9il72c:RqlIyFESWu0SWu86jYl72c

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Crashpad\settings.dat.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	87f89e841c0b69303bb5f5d8465dc670N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87f89e841c0b69303bb5f5d8465dc670N.exe

C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe
"C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
102KB

MD5
99111a6385a9e7f42e8b0f82b9bc027a

SHA1
eae4a644e2fa5270f53758e1c780ee5ac61b2b7d

SHA256
9059f3b6c5d3073d36f1dc118807c5e59edbd64a97d420d78fa16c9bcc5b2943

SHA512
9dba82c5717e03deaebef9cc767cc49965c75141a0eb60d38af5cec6690b7d85280b9fc1065ae5ad19cfcff0993b9bdc6a3a4db565b6422f45aca308f9f8a62b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
214KB

MD5
11d59bf233a1461a77a6d8ac31e0f8b0

SHA1
a601ca5079800ee3c8066e4d8ec6412b8caa382d

SHA256
b8a4bd95f8e35f69379660700df3068e6a7ac011685b7ad01aea82315841ee16

SHA512
6619f8abb5be89af5171ec7dfb3dca30e894022578af1e255ff48deb26fec743baacd0a8f268b5d346ba043643ab234fa31ee0e56af8ade45aa6dd9bdb0f6b54

Download Submit