b4f0e0dbb48f1534c9495c6fccfd36c863d27b92b79be7617d26507f2a963c8a

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9605f7e98edef52593fb49c793846b0N.exe
Size

74KB
MD5

b9605f7e98edef52593fb49c793846b0
SHA1

dbd45f099050f2aeacc6ce9b4934ab7b625cf878
SHA256

b4f0e0dbb48f1534c9495c6fccfd36c863d27b92b79be7617d26507f2a963c8a
SHA512

6c97f748c2a09e203d7209647a43d1a1b0d1b4ec99923eb4b0f9c9c26403c176ca85940e266f917634492f2c460c5ce2a3fd6ec27fec66390483644d41fe1b6b
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22v55XZUuyfk4/KJeV4YqGUuyfk4/KJeV4Z:yBs7Br5xjL8AgA71FbhvJUfWGUffRo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4638) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	b9605f7e98edef52593fb49c793846b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	b9605f7e98edef52593fb49c793846b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9605f7e98edef52593fb49c793846b0N.exe

C:\Users\Admin\AppData\Local\Temp\b9605f7e98edef52593fb49c793846b0N.exe
"C:\Users\Admin\AppData\Local\Temp\b9605f7e98edef52593fb49c793846b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
74KB

MD5
ea6a0a4e8d81df2f108abbff36dac0ee

SHA1
a97afee4403a5e8692db10dc196d7a7695bece97

SHA256
a4195fe52d94a1c3a11a3e49a5d2d9ee1c5c6aec5754648445dc6532a81cc78d

SHA512
76bca0ad4b13570510927115aadfd2ee0eac60bd717ea066bdab925ac75afbae426c6ef3fd12462f2c9c10108f5d66a3ef65815ea4a245ea57dda72601bd45f6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
acaa805c920a72b62f7ff96c7da80032

SHA1
d6ddfe60b2f4a9f36af3d2b055aa67c1bd3ecf6a

SHA256
dc0d05783d1803ea1f4b5139f711193981bf4464b9929fb130604f7890d47c56

SHA512
63467d0b115066169cd8e7ce14774da829c5cd58f12453267b340bb4f7882e49fcb5d34fdab0b8bc4fb6a21876d805821c6026f0683d5f7c419a02d85e3a488f

Download Submit
memory/3364-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3364-906-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download