97a392f6aa03c518d3e81c3da4f1b8540d32fddbb8122f82257e20dcd88fc818

Analysis

max time kernel
119s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0c85c32c74151c2ca025d4fd81a4240N.exe
Size

42KB
MD5

b0c85c32c74151c2ca025d4fd81a4240
SHA1

65b70a5a7116e1ff90142b17d701c0484f5552ea
SHA256

97a392f6aa03c518d3e81c3da4f1b8540d32fddbb8122f82257e20dcd88fc818
SHA512

9f9f1b2be939b0e482bf922e4a7f6e0d58d599ccfd9e828d4c70cac6ed7571ace4ce89cf4913bf6ced4192196085f1ca44042b8092f0ec196d5f2b0d9c99a5bd
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhvZ11F1NE7/Ez:W7BlpppARFbhjbhT1F1D

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	b0c85c32c74151c2ca025d4fd81a4240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0c85c32c74151c2ca025d4fd81a4240N.exe

C:\Users\Admin\AppData\Local\Temp\b0c85c32c74151c2ca025d4fd81a4240N.exe
"C:\Users\Admin\AppData\Local\Temp\b0c85c32c74151c2ca025d4fd81a4240N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
42KB

MD5
6f438df713cdf093bd0d260b60fb8c9c

SHA1
e0a38bd619451ca18e2afd6666d1365ab6f37690

SHA256
f03f427585e4e3d635aca56b91bbf04d5efd5baaaaf0b21cf265fdd2ebc0fdb0

SHA512
401f52581628dd14b33aa6a208f479c138f9ac563cf32ff679d047732752c01616270932e12f73a03827a1d4d2241ee22649f374eecfe6ccc092f895e83d7e3d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
16c62f791be40361fcd5fe90c0f53bba

SHA1
c4efed064d1d56ed82c638022b9f47634a18765e

SHA256
83c455220b08e4ebd0959fadac2b6d25e5d372c1ee68d0dadd6315f493c25082

SHA512
099ed3abd1a9e988abb190b09e3eb9ccd47be951d8d18fc9a5b416ddcee828f516cc3d3e6c8fbd2b8a542a8b1cf41a8c824c915d34e0a8283f22791af4520700

Download Submit