84db619e8b165f5cb372ad135bbdd002715dac4388738158db2cfe9cfcaca07d

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b2f80b7cbda214d96d1e56c1f0deb0N.exe
Size

89KB
MD5

55b2f80b7cbda214d96d1e56c1f0deb0
SHA1

979ca8b0a1fa0dd41a3682ade1e2922698c44873
SHA256

84db619e8b165f5cb372ad135bbdd002715dac4388738158db2cfe9cfcaca07d
SHA512

9c51b1ca6a7271ea0042b733a6618239d32d0654751674ae5301ec97752e6efc658874558a7e55c2dfcc430df8192db86e86a2777b579d89b5fcd3cc3850116d
SSDEEP

1536:W7ZhA7pApH9QHwtRF9qaRjvmujvmRzqzlmJgwmJg/SU3G:6e7WpHIyRF9041qw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4395) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	55b2f80b7cbda214d96d1e56c1f0deb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55b2f80b7cbda214d96d1e56c1f0deb0N.exe

C:\Users\Admin\AppData\Local\Temp\55b2f80b7cbda214d96d1e56c1f0deb0N.exe
"C:\Users\Admin\AppData\Local\Temp\55b2f80b7cbda214d96d1e56c1f0deb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
89KB

MD5
e307813918a31f3de8d8fff6e12f0143

SHA1
de5650edc84bc6aefd58e50cb722ce96e22a453b

SHA256
e3db8f33ffa297be5a452dd860d9061e7a82fff8f07300f2d7852cb486c4e9f3

SHA512
bb069cf6f000f1fdb08c88aa5d5faa90140c8d2c597945942df657f21218055d209a1c5f4b36ce0ab3497a1c880fd0980d1b66630adbef4e49c0c47b283e46f2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
fb7aa842564781864ec60aa6892379dc

SHA1
1f1e67d91c6fb63b027f00d84e412847b6e585dd

SHA256
8fe9f63dc7ef4275de4119e56352d537d6a34106e8ee385fa39ef9bbeaa43e12

SHA512
9ab5868e34f58e28d590afa0539f4602b6cbf2a76ac63da65594515fdaad296dd32ec2b32f9e4731459c04424b4d7c0843951302fa8dbfee4724f5ca22139f1a

Download Submit