68cb1a88cb4462c88f276e37d498a12a8cf93953e7b768fbe70c2e5d2ba80565

Analysis

max time kernel
119s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be8156e359032a36705fb5dcfa1108d0N.exe
Size

58KB
MD5

be8156e359032a36705fb5dcfa1108d0
SHA1

58468d285e87eb87f5dc7002ea52e7c1c26785ec
SHA256

68cb1a88cb4462c88f276e37d498a12a8cf93953e7b768fbe70c2e5d2ba80565
SHA512

a4aa160cbb849828e22b4b0c792c7e5e930e324da7150bc96f73d4deb1e09aabe21a53d6f5d0d280562314f1ebbf82525b9a6972329058799257cd11952bf84e
SSDEEP

768:W7Blp+pARFbhBgnKLMWK9WKD2N2QpQxYbMxYbyj9:W7Z+pAp2nKLRKIKqoab/byj9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\am.pak.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	be8156e359032a36705fb5dcfa1108d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be8156e359032a36705fb5dcfa1108d0N.exe

C:\Users\Admin\AppData\Local\Temp\be8156e359032a36705fb5dcfa1108d0N.exe
"C:\Users\Admin\AppData\Local\Temp\be8156e359032a36705fb5dcfa1108d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
59KB

MD5
f957f4162196fd32e87fd8af36a6d8f8

SHA1
d604a7c6a5ca308915e1f4b51cf9c9ee356ad7e9

SHA256
c73d57dea0c85c398d62d82195a5e08a2c628a0406abd4778a53ac376ee82655

SHA512
1754b430634b6c7922cb46973d1c0d85052b622498d229192d9ecb09c10f562d908fee563005753686e05dc1edb639e01b75de846c049e6b70f7a311066ba5a1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
6921abce6573f7125f54a1acb4c271e0

SHA1
9f88b9c690e8ee811cc334eae66d763f3aea3417

SHA256
678417bde1f901a9c1525718ca8da475f6ea41d95598c8841ea1e277736a6021

SHA512
de233221d8403046371407f29d83e73ed134b090317b5a14e8a6c74425752755d42b97dd94d5d195fd8692b7ab73ef3892c0deff4e0d182e0f8b9657c006857d

Download Submit