4371ac85e3031669f176b1d746487e9eb8e5f4a4e6ee600cd7de0f75d31e3896

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5b108605e9b53481623a4c5da2c800f0N.exe
Size

76KB
MD5

5b108605e9b53481623a4c5da2c800f0
SHA1

773850104242c90aad2e4d25aa1e0138246bd16f
SHA256

4371ac85e3031669f176b1d746487e9eb8e5f4a4e6ee600cd7de0f75d31e3896
SHA512

c0ed57a822d1aacee9fc9bcf642b4e4c2881f26b65ef84c60d8149b76c857e06f81c1634450ca666cf0bb1561c3bb5a65e0eed0cbe9122cad2e0f6c62ea30d6b
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzE4:/7ZQpApze+eJfFpsJOfFpsJ5DieW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\desktop.ini.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	5b108605e9b53481623a4c5da2c800f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b108605e9b53481623a4c5da2c800f0N.exe

C:\Users\Admin\AppData\Local\Temp\5b108605e9b53481623a4c5da2c800f0N.exe
"C:\Users\Admin\AppData\Local\Temp\5b108605e9b53481623a4c5da2c800f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
76KB

MD5
3ae4b1b2405ee4d2507a85fc9044f2ff

SHA1
b2c061657962f24b6a110bf517e1041f3780117c

SHA256
96bd219f2cd25167924ee966179560ef70e395978a6b9866a9fd262591489c88

SHA512
5c0381e36d3a9fb1c1ce59d654e831662e685e6a456cc39af8245739565ec61ec060933aa581abe5df4cad90f068135856a497f3432b1acf7e8f52bb712206fb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
f6c0c5e93c7bf78ce30b977001d6a942

SHA1
0ddb68192ca568e7b0445d329dc5e6bd173503a7

SHA256
10f33260fef1d05e577dc2c42a24dbd63fb864cd270cd0e6d951c112b5f68cbc

SHA512
dce9bca60f9e590704ee4ba919a8e1615cb49f3a6d87229fcd46540abe8e17338fa2a8a77479e686ef31406a0f375f254e362fa597c52e7cde9859eda1f0b12e

Download Submit
memory/4652-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4652-862-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download