1aea7e13980730f57ae3ae556e69008f43683625aabe3625f6becf8aa5dc76c8

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97f56ac09f9b371e994ba93bb90bf020N.exe
Size

48KB
MD5

97f56ac09f9b371e994ba93bb90bf020
SHA1

6cc8b5bad89b0ea91a98a190c03db7e6242119cc
SHA256

1aea7e13980730f57ae3ae556e69008f43683625aabe3625f6becf8aa5dc76c8
SHA512

1e1e72057cc9fa21b99b8b996a334ee843f0cddaa148385cd241f9704930324cf8e5e31b021ff3c240b46f19052e4b03e9400bf82b597f5d0071edf753536545
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyhbabgNT:W7ZppApyVyjVyrNT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4526) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	97f56ac09f9b371e994ba93bb90bf020N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97f56ac09f9b371e994ba93bb90bf020N.exe

C:\Users\Admin\AppData\Local\Temp\97f56ac09f9b371e994ba93bb90bf020N.exe
"C:\Users\Admin\AppData\Local\Temp\97f56ac09f9b371e994ba93bb90bf020N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
49KB

MD5
58f452c4fb038fbd7ade0fc1fcf2543a

SHA1
cc11dbd5b80f7ee6421f2e1bc5a22e97cc06d0a6

SHA256
69b4ac576507746e6b57f2fa2c22ce7fa8e0b2df6d307fafcc20712516aeb068

SHA512
b86739cc1299c733bd5fff99b6aff5816df8d3471864a1a0d68aec27d67a25b4621ce40392bfdccdd1443aad4727c2dec60b4789adc84ad6dd810fa0b3098f13

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
161KB

MD5
45663cfa9e7c0fac9ce1d99205f602f2

SHA1
7e8ad2ae102aefec555de3552290e814fed1c3bc

SHA256
c7ab8c9701955c8746e2f5a19fa0259659e32f662f0ff7095717e8f01d4f106d

SHA512
44402363e2edb72fe3c36a24d8d8d6a504f018a026eff854925b035b0909d75aed436415d02cd4fccfb9031b90484d532f26b0b2d1a829c7e46afa2523d3f905

Download Submit