e491ad40b880b41990faa02068d9070ce4c4d1aa6c9efa337252eb355dd9de3d

Analysis

max time kernel
119s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

402748c60883f94e8b597a144fd44180N.exe
Size

38KB
MD5

402748c60883f94e8b597a144fd44180
SHA1

a6a79200e21fbbddfda5b40fad98f834d01b8983
SHA256

e491ad40b880b41990faa02068d9070ce4c4d1aa6c9efa337252eb355dd9de3d
SHA512

30cde22fdd629c7abfa467f03cab533d48d3ec3dfacda78f161ef34db18e1996d303cdfa303aa57b8c5e4d3cb66c4315a49577782bf2083a8a17b2077af965b4
SSDEEP

768:W7BlpppARFbhjbhPKueKudLw1CnAkDanAkDq:W7ZppApB7cnAQanAQq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	402748c60883f94e8b597a144fd44180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	402748c60883f94e8b597a144fd44180N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402748c60883f94e8b597a144fd44180N.exe

C:\Users\Admin\AppData\Local\Temp\402748c60883f94e8b597a144fd44180N.exe
"C:\Users\Admin\AppData\Local\Temp\402748c60883f94e8b597a144fd44180N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
38KB

MD5
5350635cca273856a101c7609cc85b1e

SHA1
6272a546015109b37abf3785dc991f259ee69914

SHA256
8d2e8fa0561015407303da854a9a25e85c535632276e4ebaf0003032cbb941e8

SHA512
ae8d1fdddce4fa01becd5a3c0e138aefdccac9906029bffa85826108e7478bc90198dd649442f9e374d8a19c6a895ec6864f82ef3d54530f79fd52cd5de5c8be

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
150KB

MD5
85c885d7caa71c5cd3affb53d8dd20ea

SHA1
d7fc68d0237f0c617075c1eebafd0dc722da5120

SHA256
4d9b8292a924a4985a5ac9edad2f33317598daab7cddd16117a77bca2d1b7694

SHA512
d08f2dddd2f5aa9a1459c7a117020779b352beacdab69cf89778e1aed4e5cf03274986656772b200b4cfd92d3eaeb8045c6c1614126acbf417d0d9782cd18f18

Download Submit