e0030726136d19a742ca0f126c8b82c0bb571875f81f09ac2fa574368abdecf4

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

296f6bcbc88e6981ce82e2882829b6c0N.exe
Size

77KB
MD5

296f6bcbc88e6981ce82e2882829b6c0
SHA1

b681240c89adb54ffa1d6a67faadb658b1c2dd66
SHA256

e0030726136d19a742ca0f126c8b82c0bb571875f81f09ac2fa574368abdecf4
SHA512

823b002526e527a1aa35e027aa9905f34914d453da1e20a39a23d64de4736b988755035d54d4f92f25b50b6fe8e99df72ff4de1969aff4e169909fa32ffbd5bb
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlEG:6e7WpRaSljeG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	296f6bcbc88e6981ce82e2882829b6c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	296f6bcbc88e6981ce82e2882829b6c0N.exe

C:\Users\Admin\AppData\Local\Temp\296f6bcbc88e6981ce82e2882829b6c0N.exe
"C:\Users\Admin\AppData\Local\Temp\296f6bcbc88e6981ce82e2882829b6c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4080,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
77KB

MD5
172b5c8a1d4527191a64d353478397c2

SHA1
8c17cc771594f528e12f4ab2c0cb5fca3dab4947

SHA256
fa142bf9274e767e199642145a241de93859de39d692bd921a0517369629ef1e

SHA512
d2227a91696fd4b5c588f235b4b9e8ceb6f798e06a519f178bd1120375772f6c59175505aa02dc725fac2ebd2e7990320eeebfe61f1f9a66fe7996431ba541b8

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
189KB

MD5
227b941cf5e228560a84b72d7ff33c52

SHA1
2f3b076df5de41fd7f3c0195fa8f555079e0a43c

SHA256
68ad0b81f998f4b8ce5449cd08a2522ca95c0dabae7120f8740b41334c60c4f2

SHA512
14bbdcb2c51c0143b8b35eb1f26a41071fb37481ab4f58caa2ead64985fdf62be87812ca9210606b7ea88f7b30829b552268f5edb4e9420888abdf94347584f9

Download Submit