b2afe5035413468fcafa51b2188bdd79dcc0c2f4295b74e815612271fc5b338f

Analysis

max time kernel
142s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04dbd67c1f0687374694b65ba4e51450N.exe
Size

38KB
MD5

04dbd67c1f0687374694b65ba4e51450
SHA1

7155a0e9bd4c39afbb7e4db91dda53b219b074ff
SHA256

b2afe5035413468fcafa51b2188bdd79dcc0c2f4295b74e815612271fc5b338f
SHA512

7e3846ce0edbab7a421af20dacbe64e6017b0dd8ee2f1a8f448ca211398500764fee3a685ef446c980826e20b4510d463ea8da1d044a326c56c98ab03429e1ef
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxje6OMmy6OMmFMF:yBs7Br5xjL8AgA71Fbhv/Fzzwz16U6O

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5072) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	04dbd67c1f0687374694b65ba4e51450N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	04dbd67c1f0687374694b65ba4e51450N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04dbd67c1f0687374694b65ba4e51450N.exe

C:\Users\Admin\AppData\Local\Temp\04dbd67c1f0687374694b65ba4e51450N.exe
"C:\Users\Admin\AppData\Local\Temp\04dbd67c1f0687374694b65ba4e51450N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
38KB

MD5
a10b93083e5f855fa45ec11443b4a16b

SHA1
ae54394efac88922646e3a39f096f6344fa91cbf

SHA256
917f91add0a35b7094dec3bd198797ff0e31c8efa2f2971984bee5f8a38123fd

SHA512
a68b76e7d2df142364aa534587ca6b8655e999694d3a151c2aaa7732b2a07da3cd2550f524dae9f5add61ccc4e2d7a685ee6d3280ab884ed6fd0c4eac852c1cd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
9869037a4fd5f626c0910cf4d8d93908

SHA1
eae8bc06fc94da52afe4b05fa297a5f62fa06ca5

SHA256
3c5c4cc1797c0af7c5f4cc3fce07ef5db2b391a80712f952e25407875d311c32

SHA512
9a8d130b409eb2aa6b8107946a7f1bb685dc424acd12a662c8c019a9193282f54135a8f2a9f244a017e94d70a0627bea649556bd2574dda1563f78d74e6c118f

Download Submit
memory/4948-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4948-924-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download