a8d5d767e67ea2b4f71a406b28d8dd21700df7b15697319c9d6e38db1b0b7271

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

230232fa248db13b0c35d2c36a2d95b0N.exe
Size

34KB
MD5

230232fa248db13b0c35d2c36a2d95b0
SHA1

f67d36510cc1fae6b1831eefca35f8900d02f54c
SHA256

a8d5d767e67ea2b4f71a406b28d8dd21700df7b15697319c9d6e38db1b0b7271
SHA512

c41c373a555fa12c48d7cd5ae02b46993a36f823edcedc39de2993db4347621e0a4b9cc6c2d5bba413d4aef888508a9c258dd18d3726e7d593adacdf6f632e9f
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqtE7Ei2+2E:yBs7Br5xjL8AgA71FbhvsiE7E4

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4669) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	230232fa248db13b0c35d2c36a2d95b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	230232fa248db13b0c35d2c36a2d95b0N.exe

C:\Users\Admin\AppData\Local\Temp\230232fa248db13b0c35d2c36a2d95b0N.exe
"C:\Users\Admin\AppData\Local\Temp\230232fa248db13b0c35d2c36a2d95b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
34KB

MD5
5221ffc8a73e1a2469505f261ea13743

SHA1
4ebd37589c9002053c761e1e349d2ba34ef4667b

SHA256
202fb6f66809da45d9f3c960c4e334e69868fcb8b2628eb644b26c8730167d65

SHA512
46b762ca15ac6aed5b1cdb0a17d04e884101564fba9abc0145e900c2b6e4cd6722c744b70b3c690317c3087f7bd40b8c2b8689bee7fb2d66a668edf123d7a5b0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
3f1a0b087ab53fa936507b1b8b98f8de

SHA1
e97396e37ef5ef72de1c68cbde1b838139b62721

SHA256
16a5cb216495b28e3b004f1bf806b4c00e7f6c96535a3cb9b75b6c9cfae0d912

SHA512
4152edfb8ef8a62caa63906d24dccc109a8b11c5ec6c898944496d08c4b4af7e2aea334e2f5b79b802c39746f674d525860b09033248e57be11f96824b948679

Download Submit
memory/4572-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4572-984-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download