6d8c8b383cf428fcc96f913bc0c43bd2e925461cb5b0137938638de00d54a770

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8e809b352e3fd4f136a24aa20a1beb0N.exe
Size

89KB
MD5

b8e809b352e3fd4f136a24aa20a1beb0
SHA1

6e7b2f181870cb9fe1b826ffd6f78ed3f76cc5b0
SHA256

6d8c8b383cf428fcc96f913bc0c43bd2e925461cb5b0137938638de00d54a770
SHA512

ae88ffd2bf993eda715de4b841b86a8c7908b436535274aec2aa1371b62b59797da6340b78101beec5f105f61162cbe4554e0ceff5387f0a16811ddc823d5f87
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWSYERY:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSY1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	b8e809b352e3fd4f136a24aa20a1beb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8e809b352e3fd4f136a24aa20a1beb0N.exe

C:\Users\Admin\AppData\Local\Temp\b8e809b352e3fd4f136a24aa20a1beb0N.exe
"C:\Users\Admin\AppData\Local\Temp\b8e809b352e3fd4f136a24aa20a1beb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
89KB

MD5
c73c2eddefe3ccc71f95498c279e8759

SHA1
f67a44b12d5309029a132e4fd7c37083c86d1ad4

SHA256
b0268c8f742ece5462841ee993094e35c437685dd236c4ebb63ddae09d2d0998

SHA512
aace619ac4befea2809c8c1d4113048c5b614f533b477274b2379f5267b7308420c80865665ba6684bc9461f74aa5cb1101dab442e024eae3f6789201a6a1367

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
950f4734149b318d76d9c470b6be786b

SHA1
207a89b94c4f698d1c5257a14d1273b617cfe4b2

SHA256
09b2ad1dc3cc228bb5a9d3595add8cb1da6eac0d06e9c3de0948b0bfb9396a8d

SHA512
9d26dc4068b96ebe722e54800bd4aeb6139f9f0d81dcd498bf4791ffbac1893efda21d202532aad9b203e4e88989a06d78bdadad92bcaa0571659a7593eb3e50

Download Submit