f2a95845cc35e0313471f5fc86eb2d080ad68c93da7500111370776c5b4ceb81

Analysis

max time kernel
119s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f11ef993832be51615de4afbb1710520N.exe
Size

49KB
MD5

f11ef993832be51615de4afbb1710520
SHA1

6fcdea34ee37216d9b6ac56f5141f23e8c72a9af
SHA256

f2a95845cc35e0313471f5fc86eb2d080ad68c93da7500111370776c5b4ceb81
SHA512

e3a101d2034493ca7d8c79aa34fc63f8176d17950a704195bccc84eb63aea19b426579db47ecaf75c88394c3db3161672877b623576d8a897165287dbe5d16a0
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNKVkVYlIAItCCIntkntV/GAn:W7BlpppARFbhFAxC7ntkntV/GAn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	f11ef993832be51615de4afbb1710520N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	f11ef993832be51615de4afbb1710520N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f11ef993832be51615de4afbb1710520N.exe

C:\Users\Admin\AppData\Local\Temp\f11ef993832be51615de4afbb1710520N.exe
"C:\Users\Admin\AppData\Local\Temp\f11ef993832be51615de4afbb1710520N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
50KB

MD5
e8f7b98373ebbb943d7b5c2688968d68

SHA1
0ac1315912ae9a7d6230d49785df6d315d9d40be

SHA256
cd07cc25aac04fb2c3697f00dfaf2796a8a1bc88c8d9aadcf6c5d9513016e3fa

SHA512
82adf75912470708d87b0a04ef92bd9981cda4e26177e79ec8dc78fd8ebc4abdc98121616856341e40d9eeb2a170716138df984cceb025c2f365af1a1b4897a9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
61006b38a0cb34a126006423ad28f5df

SHA1
e334f04cc567144f7616614ecec9b8a896fc0920

SHA256
d4c746c97f9b0bd7a60ad285c72d68131b2d156b4cbaf0acf0f73074cd17938a

SHA512
3f8d627dfec74a4f89f0973b828a7975f9523d38884dd7283bc5519a900b3fb8144c287f40956c9823476467b7c3faa37f442808239cd6a169493b32ae5defbb

Download Submit