0b005187e78bbde06493c3c9ff1e250e12d71b8e92e761780d2e16154af9b77d

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1abd70bbc43499f91e4aa0c7c2204df0N.exe
Size

41KB
MD5

1abd70bbc43499f91e4aa0c7c2204df0
SHA1

dceb3d1ab819c1dc81a895aaa4ecaa8d30528e6d
SHA256

0b005187e78bbde06493c3c9ff1e250e12d71b8e92e761780d2e16154af9b77d
SHA512

99ddf242afe7cc17b09e992ae5df2ce45a4572fe2e5adeeb139d3cb1a8b33d6aef34d493fb3f8571f6ce781fa4738caad8883822724404fd6bce5fd7ca5ccca4
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3e4S04Sw7V0cZ7V0c9:W7Blp9pARFbhs101kVFtVF9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4637) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	1abd70bbc43499f91e4aa0c7c2204df0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1abd70bbc43499f91e4aa0c7c2204df0N.exe

C:\Users\Admin\AppData\Local\Temp\1abd70bbc43499f91e4aa0c7c2204df0N.exe
"C:\Users\Admin\AppData\Local\Temp\1abd70bbc43499f91e4aa0c7c2204df0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
42KB

MD5
cbcfa6443d6510c0c6ee12a8c3313af9

SHA1
8ed1d74fc008ee5c44a1b8e4b6086de8b8ff5f76

SHA256
eb1e0d9057faa994f8640f767d08be8a58814cd720318a468627cfa73420a79f

SHA512
9f9fe68f374727a66d5f91d8ebdb382b64c8d3cec495c6f0427c14f5867c88b73640775e26d0d18da9e14d2c243ef08bfd5ba005a5b842d01965f380017c0349

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
154KB

MD5
c8105b9f7cc2064eba191f40a2878ca6

SHA1
d4815af62ff381d561ca3fad2a491825e8b028be

SHA256
7bc121bf843092f0e2c8d4e9a6a709e5dda866b51eb9021619c8ede0e92ba234

SHA512
52a1be29d095596da4ff2b431355f0d9d7d5a44eeed1b5ccf0f5c9fd548f0cebac75a108b85122bb3ab97928923746ca8ace482237c6fd21c42eb683f6793f0f

Download Submit