b570edf49095809b63f0d23280184ae290cfd05841792136d173f9cf55901547

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bd0fe315177723393b23657a169ada0N.exe
Size

42KB
MD5

7bd0fe315177723393b23657a169ada0
SHA1

fb08dd234889378f8595484f99703eb9a889dc6d
SHA256

b570edf49095809b63f0d23280184ae290cfd05841792136d173f9cf55901547
SHA512

89c0b5167114055d3918a242e29c8912e23e9fa114dcff71ebc578667abdcbe12e8035ce0a69b1df2287de36d4710434aa429e1071b492c791f88e55a94afdef
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3hrjrnKvi1xDjrnKvi1xo:W7Blp9pARFbhnui1xDui1xo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\LimitUse.mid.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp	7bd0fe315177723393b23657a169ada0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	7bd0fe315177723393b23657a169ada0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bd0fe315177723393b23657a169ada0N.exe

C:\Users\Admin\AppData\Local\Temp\7bd0fe315177723393b23657a169ada0N.exe
"C:\Users\Admin\AppData\Local\Temp\7bd0fe315177723393b23657a169ada0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
42KB

MD5
69b8e3af6403cd0fc7407b9f03ff5612

SHA1
7b232b23b5f8e64bbadcc63d311f868c85c0afa3

SHA256
8905381b91b8e1578d58fb889fc931397156903163ffa2d546bad163f677118f

SHA512
ce82ee759cdcdd8c39f0c82ef34ea06aad5cacd0114a6acfc1e404b697b912319a6ca37afe0efb985c20419653f2bb852b6d91bcd16ce9716ace7826fb39c664

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
d87e1c00412bbf0b24a85f69e62808b7

SHA1
306fb8237825515b51839797ffe3c8927ef008ed

SHA256
03095472406e5a7e590bc2b0082155c53ea461b4461d8f65a7c2c0093a1973de

SHA512
905e9382a92073983a529d359cb5fa53f211144059f028278cc00e8d2af69497f8e4d815ed937d51829caf2b77c17fbbeec58fa8b56a1bdcc47a74f3c5607333

Download Submit