9d8344e2fc57f0ffedbb5543e436d818a6f8a5876cf626a986845a2e84020775

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb71572878d1f1f3acb63e25fd306030N.exe
Size

68KB
MD5

cb71572878d1f1f3acb63e25fd306030
SHA1

1438d2358ec32b3a7526a1a9541ac96bdb9ba826
SHA256

9d8344e2fc57f0ffedbb5543e436d818a6f8a5876cf626a986845a2e84020775
SHA512

9b8a02e6b8dde7969bad0edc487467a60415d82f0e5028a0a519707578b0e7a9179222dc09b02d5fd0c8a88d92b22f1f6d7334dd1419784f351338519e37ebdc
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJaMGw4PCs2B24PCs2BHE4JAIAepEM:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4658) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp	cb71572878d1f1f3acb63e25fd306030N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	cb71572878d1f1f3acb63e25fd306030N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb71572878d1f1f3acb63e25fd306030N.exe

C:\Users\Admin\AppData\Local\Temp\cb71572878d1f1f3acb63e25fd306030N.exe
"C:\Users\Admin\AppData\Local\Temp\cb71572878d1f1f3acb63e25fd306030N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
69KB

MD5
3ca68915dc055375556047ed7cb5f1ef

SHA1
fcacfcf117b070cb2d4067f93d64bddff8d28968

SHA256
6b223f7bd3e6720c558ddbbf300ce2380b2851cc9068636c3fec0ef0ed562b75

SHA512
f9f2da19acfcb278357533c04c58809cd0a35dd9edf8c47d1a8c3c270edfe92d97ca061c6a516b225094c9dda09a837dbe7c7e05515bdb50641e88f638bbd73f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
eaa092c7755ed0cf3b8082d7815badac

SHA1
6aa43226ce3c66ff5ff49748ce50f78636957099

SHA256
b04b8ed82ff51145b3a5eb6c0a5ee0b98b6c04e0677470720ee4b5eac53e4bf5

SHA512
88cac8bc791b62c74c651ae9e877e7b05b4c3e2c4be36eec906912a39238f1caeb04fc0690a2d2f798cdcee17fe0d194f7a41299df1ca57139b571c6dbc69b8d

Download Submit