bb52e6df8eb8a7fa286a92d98dbab6bb37d7011564bbcee9b32c54a6abdc56db

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c22df829492f09d34862916e3eeb9f60N.exe
Size

44KB
MD5

c22df829492f09d34862916e3eeb9f60
SHA1

dcb2f999a08c6d56f1cdcd14ac43803de0a6e278
SHA256

bb52e6df8eb8a7fa286a92d98dbab6bb37d7011564bbcee9b32c54a6abdc56db
SHA512

bf1f731ebf9dbc0013597b5d918be7dee63d189853bfb28807ed159885ceb7d6bc83bc156b9d839aa1cd5dbd18c5cf415b85ed5bb1e1a673dced63bc88c3abbd
SSDEEP

384:GBt7Br5xjL7lAgA71Fbhvt3Gb9CGDb9CGBjUDXV8gcjUDXV8gt:W7Blp9pARFbhOCQCPj3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4661) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\CompareRestore.3g2.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	c22df829492f09d34862916e3eeb9f60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c22df829492f09d34862916e3eeb9f60N.exe

C:\Users\Admin\AppData\Local\Temp\c22df829492f09d34862916e3eeb9f60N.exe
"C:\Users\Admin\AppData\Local\Temp\c22df829492f09d34862916e3eeb9f60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
44KB

MD5
ea6cf0f6c38900219135605f80293f89

SHA1
53b868a141bf856e1608a7ce5d4dc83ecfc7876f

SHA256
fc2816a503b743f8544ce2863e0a5630d9f2ab0eaf1f572ff42381d6f844f18e

SHA512
19a57bd7976758d8de5f4afb7ae81207fe5483576a0293e0f37e745fb4954addb4f8368c858990ac8923369a4bfca77f28f4e46ba084ccff0b7bd9e27f3e35c4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
ffce11fe58616bf58f7488a037c8f292

SHA1
4bc8e9380b274cb662aab0c78523897d9448c84e

SHA256
0526abfea46ded41eee2082ef253faeb40009bbabba78f6eb537c1750e98e598

SHA512
cb8b5fb9fe0f97006d802de60d7d807f78ca67a2b26f531eafd6f5f1ee9f2f61a76a9f8c7e578eedcee8df0636a92c0bd49408c7bbd412d1fef9732c63080bd4

Download Submit