99afec564bd96b0a426ec4bc0fb3a3e56630769917dd8a8727528b63e0b01828

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99926ce7c146d2bc9aed0f598268630N.exe
Size

81KB
MD5

b99926ce7c146d2bc9aed0f598268630
SHA1

ffdb6c0b22a2389327711bc6906ba703432c438b
SHA256

99afec564bd96b0a426ec4bc0fb3a3e56630769917dd8a8727528b63e0b01828
SHA512

4f320f5d9ed5f5cee06a73eb24cc7c80168d88cb8ed1ba77c1efb6ac0d531331cc3eff116e9261173caa6443003742e8f3caa03202dcfaaffac02956c4a84867
SSDEEP

768:/7BlpQpARFbhiWb8naOnaBqr8WbTr8Wb/:/7ZQpAp/EaiaQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4603) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	b99926ce7c146d2bc9aed0f598268630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	b99926ce7c146d2bc9aed0f598268630N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99926ce7c146d2bc9aed0f598268630N.exe

C:\Users\Admin\AppData\Local\Temp\b99926ce7c146d2bc9aed0f598268630N.exe
"C:\Users\Admin\AppData\Local\Temp\b99926ce7c146d2bc9aed0f598268630N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
81KB

MD5
ad4f70f17707b290e4095b05e991f381

SHA1
d699cca7bcaa4cdc09e00f8c8f5ca431f588abf0

SHA256
a50fe8ffbee2db35d2f2c63a3adac1b723c44bd94e5702368d2ef96192d1414b

SHA512
13329ffdde6d1af11d72e7dbc8bbbb2ddaa7939bf4d10c64d02abeb21979773ae8b0c5d184f8d466ac3b604a4b2811e354f8130f663f0f680128eca10c6fb585

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
10c6866606c07c18ef7535676d349d03

SHA1
d7f8c38c9776643f97f51a5825d2f73af1f68667

SHA256
4e2ecf2d4d8493a28d00fbd26240d417ad623e162fdab484fa9615bda72e88d0

SHA512
7da3465a3d6853d5f7f2082fcf591b7fdd1a4c4a9ca348c4c0bc9a9d3bd29512cfed7535d0f8e21d4b569170118a5643b6619342f039308755087845bece0847

Download Submit
memory/964-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/964-856-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download