20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
Size

57KB
MD5

b5281bf630dff3b785269edc11af53e6
SHA1

bd079580549391b7b969d788ecefd013681c3cac
SHA256

20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba
SHA512

6952f5f230aab271c411e41106c20c40c8ff827b3e596343c5c99bd12ccc329293294615c932ed2ad2b8e3bc8f4c4e8df86d5f43717c9570b4a55455e10f89dd
SSDEEP

768:/7BlpQpARFbhq1KX101GI67I7gmdGwmdGN:/7ZQpApq1KqgmdGwmdGN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe

C:\Users\Admin\AppData\Local\Temp\20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe
"C:\Users\Admin\AppData\Local\Temp\20e23c39d8c8a93bfc2fa22dc0c35e15431b22af6e9c3d8afcc34bc400ccb9ba.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
57KB

MD5
fe1a2b306fd8bf40d8c189c257d4ae01

SHA1
fdcdc0e5e960fbac8365f72021d69f2a86c4b06c

SHA256
19bcddc26ae900dcbb43e7cc8dd48d29354497fe0dab6c0862f508cb8f50fc18

SHA512
b0afa4e65f830dc928462a4c2e419760e7d9d5fee561dd5f1c38e5d818d3bcba61d1fc9356ca95dc44dd61ff0651e4f31273f80455bcddfe6f4aecbe273f9644

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
29dcd0d2a906bd811a921e882f878002

SHA1
76ca8f438b533c70bad7fb1f79603d31a6e82f58

SHA256
6382bfb975577c2438c0223dfa4e70bf129331ec4f6baec0974797679cefc5e4

SHA512
61bd7cb903fc920752c1f536d6b6796ea11c376e33ffc9e160a8cd8ba76f1d8047ea68762de80943da7583e42198107e5ede432bd12068aa8c9b3180babe0b31

Download Submit
memory/4940-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4940-904-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download