5e06a76b1d5d9200e84dfa1ff3a15acfd519963048389ef16d1467ad78b46cf3

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb57b88046f685da3c68e7afbf75f100N.exe
Size

47KB
MD5

cb57b88046f685da3c68e7afbf75f100
SHA1

d10465811704968b48a11b4e063fb9a4960425a1
SHA256

5e06a76b1d5d9200e84dfa1ff3a15acfd519963048389ef16d1467ad78b46cf3
SHA512

252c923d1261a0c53d7d5311e1b5c29130289060c4503b4d31cf95efe9c5546c3fb22650a1f53efcbddb94ce67c4d34f9a60914b6daa4cbbf6540bc448db99b2
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSxTHTo:W7ZhA7pApM21LOA1LOl6vS6

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\LockSearch.xltx.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	cb57b88046f685da3c68e7afbf75f100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	cb57b88046f685da3c68e7afbf75f100N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb57b88046f685da3c68e7afbf75f100N.exe

C:\Users\Admin\AppData\Local\Temp\cb57b88046f685da3c68e7afbf75f100N.exe
"C:\Users\Admin\AppData\Local\Temp\cb57b88046f685da3c68e7afbf75f100N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
47KB

MD5
be22d991669948b23318d3abe35690d3

SHA1
ed377d716ac235df4ffd1a7c71400084d722fbef

SHA256
c0259ef4824fd91012ea3a8c5017d5a1699fd03060e50d68621f34b5e0f0eb13

SHA512
1fe8e47608a11afda2b2a6f963e71145f08681e082a8d15ac14523567ab344157c279c8edd51601839c4b8dd2bb5fde351a029f5f1c6377c4cbefd76f7fbc4d5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
7596c4cebe86d648ea299ba9283d3777

SHA1
68ba56b533195cc97ca49fea369142b9c8b5237e

SHA256
3714f5cd7fd9d5b5eafc8b525b891eaa994a2deaf36d3f38009301069c31d553

SHA512
c4da921dba60b2f45df3548680d1732854af81f17de39ad7ead8e447962e83b2110aa6e14dab45b2611df513bd359c5c93950ee72bcf0746430bdf5c62618bee

Download Submit