d8a4b6f3ca2eee7ffe9f29db3eec4ac8178babf739f1f990c1baa1664f31fb3e

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830bbc11911386a65f969d88d7c2c290N.exe
Size

48KB
MD5

830bbc11911386a65f969d88d7c2c290
SHA1

3550a82e69c237d1a845085684bf0c00814eb37c
SHA256

d8a4b6f3ca2eee7ffe9f29db3eec4ac8178babf739f1f990c1baa1664f31fb3e
SHA512

81db767c820932dd42ca400845fc8509f6707241d39c6d2d678d76fe1cb0941bf123d59573a3de55b556adb8f6ce64702726635677f039a31626113aaa811b57
SSDEEP

1536:W7ZppApBULcfpHLcfpyDUdyGdynmpmN2o:6pWpBwchcwDsAN2o

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\am.pak.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	830bbc11911386a65f969d88d7c2c290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	830bbc11911386a65f969d88d7c2c290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830bbc11911386a65f969d88d7c2c290N.exe

C:\Users\Admin\AppData\Local\Temp\830bbc11911386a65f969d88d7c2c290N.exe
"C:\Users\Admin\AppData\Local\Temp\830bbc11911386a65f969d88d7c2c290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
48KB

MD5
5829e3f469e6d76dbfc1cd48dc55240c

SHA1
df12df58822ba0a4314ea7b1735c1e9cce66e477

SHA256
9cc29a2581bd2345c17879ad9b0f849172f719e10aaf93a494117b8de7bfcb37

SHA512
04ac646ff5d11aba30acfd994b62588026885cd919d7c7cd88d349ca06d2b17aa3d10862812f3cc2abaf2269cc929730fd599fa162be254cd6102c7764bc0e1a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
aaf61e9d0af043af5684ce5993192b49

SHA1
e3fa18f8140a7f3f25cba420d0edbf3341259f55

SHA256
2e8d2ac1e89bbdc171bd57673b38c6779ad3865f7be7fdc3f259a8a3eda4ca69

SHA512
75ff573794ba2298ff0962a7b4d1d4bd6e8def7e38c9d7aa0f75d8e292df33a6bc3abf733b93c1fee60343b1d5bbeb1fd5f7f223c621272cd9eb36024d582eda

Download Submit