2d85ed869e902bdb74d934f6bf73a56e4366ebc68120d638a5dda509d1c315d2

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
Size

91KB
MD5

2f72816a2b9fe8eedd1e22f5ebf2ec30
SHA1

fbf17ce48e3c1cc84e2636a6e331ee332bef73d0
SHA256

2d85ed869e902bdb74d934f6bf73a56e4366ebc68120d638a5dda509d1c315d2
SHA512

50f2e8e244d0a7240cb7b62e1b62fb74a5aa8e30a31f82bc64ecf13cee10d41841a4317c9985f632f7208aa9f5738420493f36e045c971031353d001151438c3
SSDEEP

1536:W7Z2sspApGg7bobSM+t58qKcAK+j4nI4VfNgZ11PED4gJQeAAUZa0EzOMI:62ssWpGgrM+t58qKcAK+j4n7ByeFU7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe

C:\Users\Admin\AppData\Local\Temp\2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe
"C:\Users\Admin\AppData\Local\Temp\2f72816a2b9fe8eedd1e22f5ebf2ec30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
91KB

MD5
0e956226358c2ebc6745f214a87a763b

SHA1
a99e85bf1bba3376ba3313fdc438dc4f978bc133

SHA256
fcdd0193ba54c9ddb5fc8b42e7d77ece559ff86d510764e89f82076f9b8124ca

SHA512
ba300b20efa4124f31720e8420c3fdef7877cdd96264b90beb66024b028ce02272bdb49d8b1c7051ef7ff87ec30d0ce06171341ecdce68c0110d5969ce102ec9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
190KB

MD5
09eb565bd112f57cf7003713626dcab4

SHA1
6b2ecb535b8b01d81bed2aea081f31116e2bd6bb

SHA256
89d6efbbf019a2301ef3f82041fad53b8f09e238d9b92672e1ca600f3c4a3b71

SHA512
1330da8ea80abbff82d40ab4788cb2fe0d7f8dc9fb229a1e2e9696a0e606b9dde5884a38cc2a59aa8a03196a8ab0eaff947f65f1e54cf943854251f13c784e15

Download Submit