c216d5346bfed8c9e76fd77d23b0c3a6431febae4a790a5fa978a71a60d0b51d

Analysis

max time kernel
119s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31bd4405efacfae31a024b9b69a12490N.exe
Size

47KB
MD5

31bd4405efacfae31a024b9b69a12490
SHA1

8e541b71e3ebc145c1b5cf2afee267559f64e218
SHA256

c216d5346bfed8c9e76fd77d23b0c3a6431febae4a790a5fa978a71a60d0b51d
SHA512

891cb53311f107ad5df7b32be90e7cab0c14aa2e84dd82ba8cd0bfde9bf90840bfa9c922c3b7649707448288f7da55e8f128b26739c05cdb6cb94053cbe6314a
SSDEEP

384:yBs7Br5xjL8AgA71FbhvBfepj3cfepj3KtLJSl2nAzKvDxl2nAzKvDgl:/7BlpQpARFbhq1K7nAkDanAkDg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4659) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	31bd4405efacfae31a024b9b69a12490N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	31bd4405efacfae31a024b9b69a12490N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31bd4405efacfae31a024b9b69a12490N.exe

C:\Users\Admin\AppData\Local\Temp\31bd4405efacfae31a024b9b69a12490N.exe
"C:\Users\Admin\AppData\Local\Temp\31bd4405efacfae31a024b9b69a12490N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
48KB

MD5
9b1d8a4e1cdf92bd12603e92f49000d5

SHA1
87646eaa6a3f38c9b0ce68343f71f7dd309b9bd0

SHA256
2fa2427c42d40965138aafe622c3e205e37b276bac308a3218de2b2c90b87e2c

SHA512
8949b5537d2eb6abe09af604cc0702c07606e1cdd6c0bbc8a9ed1bf163c5f78be43b4147d04090ebc9c7883f70df2cd2e34b941399379bf7715f1b2abdc06d9d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
e7c7ff3aae30a2708d7e5b20131c6119

SHA1
7b7223ee306824a2544bfc8c978aae247cb4f68d

SHA256
9fbcabe8d089799f36b5946479ff686baa1739d2f68740a93836f9e9058c068c

SHA512
1d9b798c3d9429442113a6afb8d5fc6a81dea315ad47ad33aef02c4b95cf37b9271c88f95f1c435d936d8f0fa7de6586f54a65b3161cc3b2f7e4a026bc9d5f01

Download Submit
memory/4548-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4548-908-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download