b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
Size

64KB
MD5

4eb46abdd112f067937cd55627916ae3
SHA1

f1f965c28b705e8ff4ed6135edc2f6025be9a860
SHA256

b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6
SHA512

15c35e5fa0cf2d9e52fc753faaa4e284c0e460f584f42bd834db9f9676cbe673f8d406e2a3103721dea4f7f12e944be4b2148b7e5d28e49a909780afe002813a
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/g:W7ZppApBULcfpHLcfpX2/Nw/NwmxD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4851) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe

C:\Users\Admin\AppData\Local\Temp\b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe
"C:\Users\Admin\AppData\Local\Temp\b350b932d0556f66d3baf46f3af4056ee4f2c368e4c24e08c8b815523d3242c6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
65KB

MD5
918f82e46a656bb398261e2a63cf3e6f

SHA1
c5a710ee99b362c0270f45e788f1ff1dc85130a6

SHA256
db6fda8aa4baaefd742eb48611ffc297b55f7a54df7cac4cb038b0f4b71c49a4

SHA512
5599b0772d230da6f0108403ca941ecf49877fb7c4e6d6bd4b71e10beccc48ffa94ad3e2bb37ca36e26e1fdf64a39b4414c756c0274e42a79099c490910dd986

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
163KB

MD5
85939f73b0c0964b1e039472a218d3ff

SHA1
543e4750b629166526246df41c8e7407f258542b

SHA256
d0523c540c6eb82c9e5072d833ca424bd50f5d3bdda4ca4919b39a0c0427b8ab

SHA512
53e5939d7bc38cd87a1c3f1c6d8afcdc3cda9649b973023dcf109a32f22287e55f7a3baa7d04555f3c1d789fe282eb17468753000b4b88d7e9efb2f1c0590713

Download Submit