bf7eabcd2a9d3157034e7d764098f76507b6d60d2d8ddf727c4a3cd86e5e4ac6

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11930d4256ee3ccac0512c66fd573700N.exe
Size

45KB
MD5

11930d4256ee3ccac0512c66fd573700
SHA1

5dc98f9b3f814858689483c39bd6b5b78f6f1913
SHA256

bf7eabcd2a9d3157034e7d764098f76507b6d60d2d8ddf727c4a3cd86e5e4ac6
SHA512

c268927244b398641ecd309ac8810113fd12dc2c801d5ce90201dcad59ba1a0e872997f81d923c54be63b712d093ed96b4aa819636ba5f0db1c478fc58254686
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltIIRIUI0n0uI0n0q:W7ZhA7pApM21LOA1LOl6AJn0Wn0q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4592) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\desktop.ini.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\da.pak.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	11930d4256ee3ccac0512c66fd573700N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11930d4256ee3ccac0512c66fd573700N.exe

C:\Users\Admin\AppData\Local\Temp\11930d4256ee3ccac0512c66fd573700N.exe
"C:\Users\Admin\AppData\Local\Temp\11930d4256ee3ccac0512c66fd573700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
45KB

MD5
6e4fb1a3339a0a1d740a6f5385205e80

SHA1
3801ad2c104054fb65baadb4296c96c610225d7c

SHA256
c3f4989722c6dbd2b88d86c6677332621734b1d469b8aea1a8c462d4c69af569

SHA512
faa63e56a2ca39b42c4b68bc08426f9c12f714c2e81c90b5d87808d0c0b884ad910ec68e10a1d94c88d1568c9db6099e342dececc9f13768ae5fead29ffefe1e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
da92834f2bf3b8b7c8b7563e8b26bee8

SHA1
4b8915b58367beed7389897ee4919dafaccffcd1

SHA256
ace8dc9e01d305e09ab2bc8205b4d5aa1dbd5c424f6ab7187c6005d332ca2fbb

SHA512
dc5bc9ab6801b341f25ef2d528b7f30309f876d6eede983c914763f8bc7b2ec8ba81d62a6c77ac3b32382917a5267e0e6197dd9eac96a8ef78c61f1a166676d9

Download Submit