be21382c1e1c693abd091accfa3d85905f5c565339fda770faa83a35f7d67c29

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31670441504513bf7e1d9ffe4bc38b20N.exe
Size

38KB
MD5

31670441504513bf7e1d9ffe4bc38b20
SHA1

bfd029dff124716dcffd2785805e2903fedca014
SHA256

be21382c1e1c693abd091accfa3d85905f5c565339fda770faa83a35f7d67c29
SHA512

597bca7a88e342519e10888fe95315df2fa418844805a4f941e7d4e19bef339c9546208abb8e776fcb1724c7f18e48a1073691ab82ffbfce01f5500dad96eba7
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lswQ:W7ZhA7pApM21LOA1LOl6F

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	31670441504513bf7e1d9ffe4bc38b20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31670441504513bf7e1d9ffe4bc38b20N.exe

C:\Users\Admin\AppData\Local\Temp\31670441504513bf7e1d9ffe4bc38b20N.exe
"C:\Users\Admin\AppData\Local\Temp\31670441504513bf7e1d9ffe4bc38b20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4512,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
38KB

MD5
c816b2ce470b54925d8c6d7079616671

SHA1
9cf58c2815ec363de98c1ae3b65472a005b30794

SHA256
bb4788bc10ed791a95114547e118526a00522391c3176cf2d6cc5cc7a52ae413

SHA512
b516877f6fbdf039e51f478ad2e7dc39b641667cc867baa492e9a6926706926eb901a0f22caa2e19c47a01b7b0ef9b0f33c2385ec3942a85220f81c106b02846

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
151KB

MD5
b5475664c321087024bb46d7200fe456

SHA1
22834199d6fa22c0a356a30478c7a4ab0a845e48

SHA256
9632b6aa197b205fd1765b89ed0607027d4b1fc7b9a4d91aceb7af34cd6977ce

SHA512
e2308824cc076c0e1329637bf0a75aaa57ae5c7e128c3f16dc893c41b0c66783ffe01a3ba8d5b715b4c4819384ceb8b1567e992f7df8eeb06369e3eb564b41ae

Download Submit