0d5b4168a5e4abe71a8f34e904300c87ccd5510520faa6674081908ede2d95af

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

236731f0e06533c914cdb4cefde03140N.exe
Size

79KB
MD5

236731f0e06533c914cdb4cefde03140
SHA1

8146384fbfd9a66fafffb64c90626d7567b20bb4
SHA256

0d5b4168a5e4abe71a8f34e904300c87ccd5510520faa6674081908ede2d95af
SHA512

ebe7cea5d19b748f815faf6d591c811e65173d8af3e51ddd6da24e8be9f60ea77bb26d21a15f368b9c468deaf99a54a956f7fbee826adcc0da4756933f7ba5af
SSDEEP

1536:W7ZDpApYbVK4vx4PN54PN4OHepOHeZSF79:6DWp7Wf

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4378) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\FormatRestart.7z.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	236731f0e06533c914cdb4cefde03140N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	236731f0e06533c914cdb4cefde03140N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	236731f0e06533c914cdb4cefde03140N.exe

C:\Users\Admin\AppData\Local\Temp\236731f0e06533c914cdb4cefde03140N.exe
"C:\Users\Admin\AppData\Local\Temp\236731f0e06533c914cdb4cefde03140N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
79KB

MD5
e05c1c4c52ab81e1287da5da86112451

SHA1
be790072099fb3747a6a099d6bb7b6e70aaad5ff

SHA256
7cf0d3750651da130e17aa83d3a2506aabf5d308afb07160124016124cfbc85b

SHA512
97facefd95b56a62b11005ce790b6f650f8a6adf6aebc4bee839c997d08d78ae93300dd77e01fd7246c923acb4f7e4e3a9410bb284ce502deee66be7d1e4e467

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
191KB

MD5
3665fcac92b0b04bace01194c840807e

SHA1
6ed637d171dc2032822f468b9b9133a55ef857b4

SHA256
5e4f8438f2f516ed83ca50df9e257fb698956263033b45c5f29156d0251b28b9

SHA512
051913a47f736a798124f7fbc5a7ec184423df1e643a4ae6edb5dbd1bbf5659668b76919994e4859991a996d5c2260f7bbf141689d2950b991ec6cef6e894d03

Download Submit