7e301c71f0f6f11c9565599bbcfb7df1ea092280a3a5637eb4eae18f65a8ddc6

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

065bee5daf9c192b0bf2a0d982fdb020N.exe
Size

76KB
MD5

065bee5daf9c192b0bf2a0d982fdb020
SHA1

89a49a6f3a55bcf295eb2491224a98db8e509ddd
SHA256

7e301c71f0f6f11c9565599bbcfb7df1ea092280a3a5637eb4eae18f65a8ddc6
SHA512

b1f8c4e265d812c0e9d1f76ca84b7f7b7583e9ff107b70128f77fc4d481e687a7f0d164784502a9c1c91ef625f3f337c98fee87d4ff601b35c82cca3c5b305b1
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvB:6NLWpCZIzjwHwT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4755) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	065bee5daf9c192b0bf2a0d982fdb020N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	065bee5daf9c192b0bf2a0d982fdb020N.exe

C:\Users\Admin\AppData\Local\Temp\065bee5daf9c192b0bf2a0d982fdb020N.exe
"C:\Users\Admin\AppData\Local\Temp\065bee5daf9c192b0bf2a0d982fdb020N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
77KB

MD5
0fea3c92bbb2d789b60837fa32c95a86

SHA1
d7f7fe8c70e39e50d8fbd6c9ef263bfda5c987d9

SHA256
9d7c39ad84311a4f0192a15417e1f867f37b7b4ae254e24ef26d7b3b359035e0

SHA512
e5e68dc8d72533cba34b209dca157e9508a0cc12343d42f4af046dc04301c16fb8f10588145a14b59f47237b2c3bdc13dc47bea2e94604fb7d8c162884f419db

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
340a0dc6837b35db1dc3d4d7ef6e8a9f

SHA1
0608d453f7cb633374f5fff2de296acbaa94da88

SHA256
ad3dbcbee8b117a17387e444df11769ad5ebff4268457a2c41980df4475ba862

SHA512
8df9182aaf8df73e0fb435bd145bb25089a676336dcfdb8dc02c306526bef2168b2464a6ac378ec8bbe3ba7637814d889b77e2f19f150d66f2785a223ebd6661

Download Submit