bdf9a6e2a68ec61be32c0bd2a1455231b2aaac0f92f9d10daa31a1dc29b2d9b9

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e2a297adc6511f3d0c166991254a7f0N.exe
Size

96KB
MD5

2e2a297adc6511f3d0c166991254a7f0
SHA1

884aca836ddd81dbfb742328ce79232d7909c2fa
SHA256

bdf9a6e2a68ec61be32c0bd2a1455231b2aaac0f92f9d10daa31a1dc29b2d9b9
SHA512

113c095ef10b4a498f7fe6bbda75a9ab93663ffa670115cbc269889f26b2fcc9fe953d08c876118ae3e42200a07224ed7f95d8835404ad810a93fe1988144e1a
SSDEEP

1536:/7ZQpApg9u9rYmdC4cq5AMaBikyJ+s6LiU33:9QWpyu+JDIkyJXU33

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	2e2a297adc6511f3d0c166991254a7f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e2a297adc6511f3d0c166991254a7f0N.exe

C:\Users\Admin\AppData\Local\Temp\2e2a297adc6511f3d0c166991254a7f0N.exe
"C:\Users\Admin\AppData\Local\Temp\2e2a297adc6511f3d0c166991254a7f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
96KB

MD5
dd35708d2606273ee0f59c97db8d3ec9

SHA1
c784b800ec1c12cc82e9a37c5186d53d269efed6

SHA256
000c682a59e95a3f62182aa3188f0b0903cdae32347c3e84d2178c1ea8cf10eb

SHA512
96ab20276f7742fdee97f59809b2ac71abab1097c3e03e8701174964882fe723b29e5ce9ba10d827b5f2cdac9b20e4c4689db961136d3a964ca31c8d968d5d19

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
06ec7031db46688f9336b1c5f71e6992

SHA1
6e5915aaae4e5a0c0fced6f20c46a023784d57a3

SHA256
13dd1c0d3c51e3cf640e25c3d480365658b0ecc6f62a79fb85cf78024b91d3f3

SHA512
569fadc360cd078edd2201c008efef3df8f3a3af22c9dfc6321f2edb6b754443b4c3f3501a3f64634cfae6050132a33dfa6902e6eb061b7c055cf124940cd303

Download Submit
memory/4652-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4652-860-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download