795a2784a19adf6a58170a8f47e9a0f221ae03f095d644bc994f8fd835008227

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95eb19ac82dec30b4f073ad4e1269890N.exe
Size

97KB
MD5

95eb19ac82dec30b4f073ad4e1269890
SHA1

fff7707054a6a6b87ec32d044321e44516c932dd
SHA256

795a2784a19adf6a58170a8f47e9a0f221ae03f095d644bc994f8fd835008227
SHA512

0d8eaf827789f260767cbcded7b5a337a8629d3bfe7de3e4c7bbc38cb0db04e3fc766f4246f3c566ba79bd072bbe370a69211ea9b1e948638d85b1f2410f05cd
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYLp4f6:6e7WpMaxeb0CYJ97lEYNR73e+eGGTf6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	95eb19ac82dec30b4f073ad4e1269890N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95eb19ac82dec30b4f073ad4e1269890N.exe

C:\Users\Admin\AppData\Local\Temp\95eb19ac82dec30b4f073ad4e1269890N.exe
"C:\Users\Admin\AppData\Local\Temp\95eb19ac82dec30b4f073ad4e1269890N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3932,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
97KB

MD5
97605bb84bec92c7113b274243784d2e

SHA1
038fad096e4189b398e42d04d908ebedd77302ae

SHA256
9cdbbe9fb1a2c08cd7b6e738fc075609f5567009892906dfb9d08471b1abb403

SHA512
94f0a777c6f186ebe9bc85c71e19c070bd8e49051d2a02f48d470a51a0f672043ddb7ff7a4a36d690ee230035b8419ad807fa50d823b28699b090256c117bef0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
210KB

MD5
41420c231207ea0cf83694450493e847

SHA1
b0376ebc4210711326b863ee6ab589fedcaf8153

SHA256
233709d378932b6b7721bea0ccd4edb78fceb824e3c174709706e05c18420655

SHA512
d6bee2d53990530a127b098dc81e8006f91ce32fc4a1a37979cbc27a96414b644b5f81b565dcca45de0a312babb1b01e1c3829989ecb045e18cf482a68c6f089

Download Submit