e95c56c909afba6dc3a232b04dd2dabf26b28ebba80cbf3aa15b86bb98c4a416

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

104048caf3a1c116a5c19f582fbefc90N.exe
Size

72KB
MD5

104048caf3a1c116a5c19f582fbefc90
SHA1

431d39c8aad32a72a5fb23a3fe3b8b217de3e87e
SHA256

e95c56c909afba6dc3a232b04dd2dabf26b28ebba80cbf3aa15b86bb98c4a416
SHA512

a8b4a0dbd3a8392acfc6e363b66810fbf541e5eff18fbe31f72090c7fc4b529a0fa3be2b1658961a520278a74c69fced83686a3af4721575ae51dc13955a3a1d
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZv+:6NLWpCZIzjwHwE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4864) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	104048caf3a1c116a5c19f582fbefc90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	104048caf3a1c116a5c19f582fbefc90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	104048caf3a1c116a5c19f582fbefc90N.exe

C:\Users\Admin\AppData\Local\Temp\104048caf3a1c116a5c19f582fbefc90N.exe
"C:\Users\Admin\AppData\Local\Temp\104048caf3a1c116a5c19f582fbefc90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4376,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
72KB

MD5
2a5b7c141a55925ea7f3611e6b8c9b58

SHA1
36f6502225c21197371a1eca58419604315904dc

SHA256
08d85338bd2dc007039bb5cde9eafeefb6c95e373e84d0422073e0223065ab75

SHA512
9d3b4e73f4b7f0f3148f42c5a606b3eebd529ed39edc8da389e6cbde0ea4eeb891018ffb644f95a9f72ebfb8c33c4b579a7973cc68cf41acedc727166202a1f2

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
184KB

MD5
7bf1d11cfd87984bd26262f550bba39a

SHA1
5c8dc1e40f60997c9bd689a2277bb9f2ce4a67ad

SHA256
e5a1718aa4f5723393d8ab529fce90e06879a96db4366eaa54ba2c9cf044eb28

SHA512
15749bf0d1dab83ff7b7b0810c381f784fe5094f65294371a17009e79516f4361948e1ea18b77981ba938f39df04e271a5fd0487249d35d31372142f153db12f

Download Submit