c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
Size

91KB
MD5

8a694cfafdede3e073f0e9dc63a8742f
SHA1

9622459d5ccb60081ce4361b6d9c6d4870a247f4
SHA256

c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588
SHA512

6d66f1e8d64ff898bf17de977dd7046a375f1d69b3077639698af39094964b84486192128dc60a7beea27ac734196e3653dc2359c089a0a29c6ffec43cfac81f
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKgg+EvBnHHwTVEvBnHHwTB///O:69WpQE0zxg+TPnO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe

C:\Users\Admin\AppData\Local\Temp\c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe
"C:\Users\Admin\AppData\Local\Temp\c0f31d961604cfbd43b5e7669a07ab1a5928ccbc9be3b17432f4a582e02df588.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4264,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
91KB

MD5
9cf4978f060343e0c8d7bc5319620dbb

SHA1
eb559b958e33865991dfd0161f92f321bc431cf0

SHA256
f1a9e799f9def58cb3cac7a1cbe3874b8df4aacf9d30e30f8da0616cb38b87b3

SHA512
e8a2be57c7e0c8577e7048b455dd5b63f15b37095ff93d9548294e14b0db172f754359b60818d8b4f05ffdc6d671fefc0cc3554a40ed170515b5a8b1577e6f7c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
203KB

MD5
c080b31addd626cf127cebbee50b875a

SHA1
364639d2e4dd95104b9963447915c9600d24ccf9

SHA256
1b956126320cc894a2ca172823e2995c088f5d7f310650a6f250ab327b04677e

SHA512
e140c90257c035697756a47fcb1af04ed52109f6c6d9ad9ad5d3187acea7cc639f9d08f7dcb27f1f98cffb161d973209bf1f2ed58b3f7503e62bd53c3842a061

Download Submit