b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
Size

48KB
MD5

0e4bc37a74d85522b9fb2cc888759da1
SHA1

348927d94b70b1cb251d2d232a053c0a241a8bb9
SHA256

b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f
SHA512

72954851f2eb92610220aaf09a237105e437370989fbd87e8fc53ed6ba7d974158b059c37a75b99080f73a33eaaeffe08d1f241ce5d718294e564729979eac22
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLe:W7ZppApBULcfpHLcfpyDx

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe

C:\Users\Admin\AppData\Local\Temp\b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe
"C:\Users\Admin\AppData\Local\Temp\b65bd8ad2117598f47808cdfa2daff1897e706119055db2ee36a2f34e54f8f3f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
48KB

MD5
e5dc5108b52147c92e9b7f370f96f92f

SHA1
208c8c8cf9c6fbf44091f24c99ac47c88c796aeb

SHA256
f3615fb6961019daa836f66651f91ce4150093660e5e541c93b70247202f731c

SHA512
ead149aa8f23333e890b2afe87e923db56125a3714ec43358999e435af2075ece9657c673cc1bbe0b6283ea9ddd0e7605853214f00b040489ef78dfb7514af7a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
a98397d185d3de4597b5c25a27cc0a09

SHA1
18402ad00d57e1d994140be338692d6250adff19

SHA256
75b2f6746ef270ed0601dfa745877e4b883dd0d47fcd941756b292da8c538e85

SHA512
a829c2ea4a2f824494f96df4ed2723daa6fa0e2f5b2dfa589d8b8cd220e7272154145ba068e1d382482e5ab35a9ee4799f75c2f59e8b30e951df070fbee350c9

Download Submit