49ef782237cecc5bff7e3e2bcf836000322513fa457e64fe11f5f05f951b4a43

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
Size

94KB
MD5

20ebc18bdd545f20d3a29a26e3aa9fb0
SHA1

8219df6c9d5c36820dbeb7f706a2965062799f56
SHA256

49ef782237cecc5bff7e3e2bcf836000322513fa457e64fe11f5f05f951b4a43
SHA512

d18e30c916bf5caadf6cb9fc3668074cb5aab11199367e3b1e31fea16fa3538be60876675d961c005670b39df750cff0768f7f377d91203df50fdcdef6ef41ec
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQex2D:69WpQE0zUzXA

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4538) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20ebc18bdd545f20d3a29a26e3aa9fb0N.exe

C:\Users\Admin\AppData\Local\Temp\20ebc18bdd545f20d3a29a26e3aa9fb0N.exe
"C:\Users\Admin\AppData\Local\Temp\20ebc18bdd545f20d3a29a26e3aa9fb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
94KB

MD5
89af7ea15aa9d7299a35c30a3527abb9

SHA1
5ad20eda22f2a11b8ec2f7c7f1875430dc0a74d6

SHA256
d02690c4db9ed7a921746c45c5f33ee372d25f74a0c401627ee5acddbcea4b01

SHA512
bfdb872b05a2d3d370f0dc61dfe5d1dcdd0fb2a84cf51239e4ca0df58671fa05997fa0d88b26973c2cd45fe6bd3904d3f8183cf2375184cb6aa091a01c52ac5b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
193KB

MD5
26995776a32cb1ba20f9adf458d70a90

SHA1
12171bf4e3357ee199aff9242b072fb2165d9b5c

SHA256
132ef298a428e90041364ce8ccfe2de694f3c8d02a59943bcaad906a753ba2e3

SHA512
4824f8e64be9011b930250fd351232a71718625256ab8310f77c22364ab2a1d286ac07a1e834a4d38ce54b6cac87a05a55eacdb9e240df7cb0d2bd94bb6d1196

Download Submit