f8d7e79b34f89d9935eaf13ce3c38a712dc73e8b0d1f682a788bf8baf6ff5633

Analysis

max time kernel
119s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf36d35b75316a5451bae74588e4d90N.exe
Size

69KB
MD5

fbf36d35b75316a5451bae74588e4d90
SHA1

1355430ab8ee28f3933dfdfa2a67012ea1c2baca
SHA256

f8d7e79b34f89d9935eaf13ce3c38a712dc73e8b0d1f682a788bf8baf6ff5633
SHA512

ef72fc8e727bcc40821e8cbf0c57a6837059d6116d744d2227ebd22325d8df714a90575207d9bf1f37859417a8c8a8fafe7602e0c2a8f7d6acf370b4d2adf023
SSDEEP

1536:W7ZppApwEwnmJARJAaXxXNJdkCKPuJdkCKPSSZSo:6pWpUnDXxXs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	fbf36d35b75316a5451bae74588e4d90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	fbf36d35b75316a5451bae74588e4d90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf36d35b75316a5451bae74588e4d90N.exe

C:\Users\Admin\AppData\Local\Temp\fbf36d35b75316a5451bae74588e4d90N.exe
"C:\Users\Admin\AppData\Local\Temp\fbf36d35b75316a5451bae74588e4d90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
69KB

MD5
aa75a192a5ece0a0699eaf10c5f0cb00

SHA1
ba5a5d9e6aaeb6ac3207eded73ceb6d4c4133317

SHA256
46169b32a63db1bdd767fa80690daa11bf04d0b61302a31776c6a5fe19957616

SHA512
eaa95eabb793dbceb210152ed7e5a5e1c5d19ef4adbac87600083dba430ea41d45f875406a0ab9767a600bf6e15407d24203dda1321643d89b5284d918140c77

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
83889c89279ad4fdc8befff1ab6cc9e6

SHA1
e15c045f009756c9a8c724d8c769a5a3bd6f7288

SHA256
d885788eb9d74ca542df66a66d84bcc39f9e4c448e3ba1030c084916ff825937

SHA512
ac56d53bae4e4a8be21b38b754960f9b80e4a4a7ecf1ed006c73b205f657c255bf49a2a3c4c461bd1adbac17d2bf52a4f8c0c330979eb3a75dd253509cc14478

Download Submit