4585313964ff51f3098f29d1b2dc0b5473114a12b952234b62ce28b2192c21a6

Analysis

max time kernel
115s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d1de8150f819ed739984e56933aae90N.exe
Size

50KB
MD5

2d1de8150f819ed739984e56933aae90
SHA1

bdf91c94d7050128939472ad80eb4c00dfdfc368
SHA256

4585313964ff51f3098f29d1b2dc0b5473114a12b952234b62ce28b2192c21a6
SHA512

ad398527dc20c524695a8d1a798bf34a5364fb0dcfd407d5362d2ffe43ec0c3707f1fc00396cc3a3e5f0f815037211e7e73f345283be75915d0aaafe00da86bd
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLPCsZCsWbabN:W7ZppApBULcfpHLcfpyDEdL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4385) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	2d1de8150f819ed739984e56933aae90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d1de8150f819ed739984e56933aae90N.exe

C:\Users\Admin\AppData\Local\Temp\2d1de8150f819ed739984e56933aae90N.exe
"C:\Users\Admin\AppData\Local\Temp\2d1de8150f819ed739984e56933aae90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
50KB

MD5
cbf84fd2c21e349cd22d8850c0c1fe86

SHA1
56f848c17374a62502c3a6c4084f9faeebbd43df

SHA256
9f47083a53f8b08589ebe233fb06bc9def184a6beeab21cf5ee6304c4d9eaf47

SHA512
f999efd4d81720c9fd6881a2855e423f539853ee762deed98d44a920ae4a193359d460196053d64a5a21a943908caa27c2a0975cc1ed986fd91cf7fee284860f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
28bdcd99d9cf103f6dd13b1cf9fb3556

SHA1
254c5716f51cd852a9fd5376aa100c5af7d21295

SHA256
50620e55237f1a0aec91986dd3d80dcf0e27a26ba922ccca30a7e024e9f9d44b

SHA512
5b0c25feb7ffcd8da144d31acc55de90d26cb9cbe5324cea59fa5dcc847d5c26ee0351697b16dfdcbcc08eca22ca802e30d6a60decb0699d512afec839311ddf

Download Submit