be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a

Analysis

max time kernel
119s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
Size

54KB
MD5

cb1a3f62e1ea3e87b3165a18a25eaa80
SHA1

577e5dda3999746857c43a07616bcb52e5559310
SHA256

be31d6d92cce9a0322b89ae2e04b94a22b23dbb1b7093ab5e99e38a4ef9fdf5a
SHA512

8f2378e36b1ca6e22dac5468ca973b725204f1f17a5fe7846b4daef163c54da0d1b36f36495c611088389ea08cc78d3288f8902ac7e4c9813a98e55c2b91b7c0
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0I0gQemyq8gCgQemyq8gQntn2:/7BlpQpARFbhNIiJwsJwwnZGynyrntn2

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb1a3f62e1ea3e87b3165a18a25eaa80N.exe

C:\Users\Admin\AppData\Local\Temp\cb1a3f62e1ea3e87b3165a18a25eaa80N.exe
"C:\Users\Admin\AppData\Local\Temp\cb1a3f62e1ea3e87b3165a18a25eaa80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
55KB

MD5
e560da5cf3f53a6549aac8e3f0c0cca8

SHA1
a1ade1368a823084912948bc9571f361e07dcacf

SHA256
41d82267e47b6e3f4f615c650ab9236ef9eb1b1272cae4cfc028c05da4a151e9

SHA512
b5e620a772a31a768b244b9f55faa8b735532788b204d974b9526121a0654e5fd764be85c90ced1c6638f949e424e79a7fc4ce8ce4b4b50453b47fc87952b7c9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
c5827b116f66ef82827a29b13bf4ed10

SHA1
22e609bc788c5f02052833b90f28ce3367ca998a

SHA256
eb89fe7bc4d060384d8041d050073b019ec05e5cd40d3efa1fd50f3ea12daea5

SHA512
153ee4c9102f86e9396a97dbb8bd415bc8b21f69afb417ba27ad61e0ede1f6ec81270545f8823a80cb0976c26eefcd684dee6de07a0863f64ffcf9c8bf555957

Download Submit
memory/3372-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3372-1004-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download