030b0c911585e6d24d480c817f34fd9e157146a89607710762f15d62380d9099

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99168f0a5be4accdb8c6cb07b24376c0N.exe
Size

48KB
MD5

99168f0a5be4accdb8c6cb07b24376c0
SHA1

1caeb3a88f9017905ce51b02f4389becc2e29ec5
SHA256

030b0c911585e6d24d480c817f34fd9e157146a89607710762f15d62380d9099
SHA512

c1d39001d9c74e2f8f6bb52ca6f5ceffdea5b769088c35f6093de3abc6baa77b8a5c2bb71d2d39acf8edb5d96bccf97c50304848ef3317b0a39d7b1397ec88a1
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0Iqja9jaJS/A/A:/7BlpQpARFbhNIiJwsJwwnZ+S/A/A

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	99168f0a5be4accdb8c6cb07b24376c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99168f0a5be4accdb8c6cb07b24376c0N.exe

C:\Users\Admin\AppData\Local\Temp\99168f0a5be4accdb8c6cb07b24376c0N.exe
"C:\Users\Admin\AppData\Local\Temp\99168f0a5be4accdb8c6cb07b24376c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
48KB

MD5
e836abd30b203ddf59e86c1e9c3b31ce

SHA1
95213d093f4e7891f9e9e78420b79678729de43e

SHA256
be222af1f950dea9f3ed403aa85486f33e0e9b0b72a1ad994d53e5dcd122eddf

SHA512
35c010ba8deb3b518c729c7c2efbb8d45f5af6280d2df8479d2cdc8377441df9b34f46738b4b1761fcfebb92af502e748ac417278f6ff47b1fbfa76642e718c2

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
160KB

MD5
fb8b54d7a045375762de74454e7d18cf

SHA1
05ca7ff0823e2e875c5e5026a08ac371cd363bb2

SHA256
a58f386f09d3809260071870fb6d743a31fd6abfad187fdd719b9e6161e89e34

SHA512
65811ef530f653d6cb4a1f93904e4df837b80e729dc528f5d9740457bda9c9138addadc1e9d62753cd502ec1f711f1d01e09556f5f1b2ecdb120336afcfc81cf

Download Submit
memory/2416-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2416-860-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download