ed82645e1b2844529bd5ec48ae901d50b9832e76ffe2bd523a7465c79a7da2f8

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80c3cb0da44b2d95cc863dff72e44ff0N.exe
Size

80KB
MD5

80c3cb0da44b2d95cc863dff72e44ff0
SHA1

549e8e96372818ba750923f55b0f65016f1f761d
SHA256

ed82645e1b2844529bd5ec48ae901d50b9832e76ffe2bd523a7465c79a7da2f8
SHA512

13b5fe3062cf2b21786d29365e5d09d135fc6dfef8e5ccd6141147d73983143c53b7a062a4d10095d87365025908e886edac0346e2e9997287a86053b19ccdf3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYjhe:6e7WpMaxeb0CYJ97lEYNR73e+eGG3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4511) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\ImportGroup.wdp.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	80c3cb0da44b2d95cc863dff72e44ff0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80c3cb0da44b2d95cc863dff72e44ff0N.exe

C:\Users\Admin\AppData\Local\Temp\80c3cb0da44b2d95cc863dff72e44ff0N.exe
"C:\Users\Admin\AppData\Local\Temp\80c3cb0da44b2d95cc863dff72e44ff0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
81KB

MD5
afd7deaa1bb771f744fc46c28406c181

SHA1
908578c11a4e1545cc2fa2421c8ce6112d2ae36d

SHA256
431b6ac9ff548663d3bee9f8639e894bc89725e6a97b72b8e07f143783980ac0

SHA512
eefa64016b65906ff5fd02a39fdde74d44d0e69c39c3cb68135e5391b51cd6f8ecebb89355e9321a316ab2c33699d82c7c6f10eca65d2089ccf344f4d35989e6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
4035d1595d598f5a90995b0e4d1905c6

SHA1
e913fba4301dde4c435464a014dcc2fcc16d9bf0

SHA256
f87422b97d301680244033279f6f28f1691ead6d5aac78ca018da0b3e07ccb20

SHA512
33a7ea14c55df3de6f6064a2840741b3816f02e02088853f3ec26cddbd0cdda77d04486aea307d4a31cad6f5cba09bf3b711603e5e2d44fb02ec467e6b20ee97

Download Submit