30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
Size

43KB
MD5

10109c63f8d76de58e2bccff5e479a55
SHA1

0ba6f82f7ae7ac932f8cc5870426f99df44269e6
SHA256

30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904
SHA512

e8cce9181502e55fdcb16fc3ca20fe0ef1ca7671c5424cb021c6c77f1e8cbd712a82c72c100d06a7c83e1c9654df4ad08beeda23e38ee3aef3848d34a8730d4d
SSDEEP

384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaIp:W7BlphA7pARFbhL801VvM801Vvv7cYX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTCORSVA.TTF.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe

C:\Users\Admin\AppData\Local\Temp\30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe
"C:\Users\Admin\AppData\Local\Temp\30c68cf147bae25d995691ed8135b6447ba8e6d8c4fc189b703e1cb43b352904.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
43KB

MD5
289ba25c4c174d160e99dd57ec863801

SHA1
01acb1bb83e7f55605269fdf2c5f169e663080c2

SHA256
259f295014afbc47a1c738c8d19459f7faa6e05027c2ce9e8836c4f33996e710

SHA512
bcac20ef784d59e2553a26959c1cbb966ae58d7620c2ae901f29d9f58035d7c3f021389e8fc202de5b46cc1a2eba8dcb4c8015e33ef29ef079be23cc71773487

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
a91ede5f08fd8c91880465d17dca24af

SHA1
a035e03af79085f21f2ccce6ab6ec91e45f36b77

SHA256
6e6fce6f217b80e006c50c88811588a301b396dd9c6b8eb6220d47d83ae6fa97

SHA512
ab3a4062ddba7ae3431e899f9e9a06061bebcbd1fb1d1c4892c667f0156427131e31d7bba4e0596d36ce37816000f566a16177bb2069c179e804644d00b1b9e4

Download Submit