f30c81ed4b090ea9da31912bea660ea39320e9a67f9012c5474e2e2a14f9cb8c

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
Size

83KB
MD5

b4415cac8dd4c8e0ec6bd09640c44cb0
SHA1

1cbbc4f2b88741b93ca9a776d754d7f200cbb5f4
SHA256

f30c81ed4b090ea9da31912bea660ea39320e9a67f9012c5474e2e2a14f9cb8c
SHA512

fc1a99b6a3ca5ed8a83a07080d5e57af1c488f1033664f3c4e59537c826ba829c39d61fcef7cbb7a53a291bf0dc47310f28b16d965cc0336b6979a1370d3b439
SSDEEP

384:yBs7Br5xjL8AgA71FbhvJUfWGUfHjtmjtd5NaMR5NaBQNNmPx/Pxv:/7BlpQpARFbhiWb8naOnaBGNS1l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4379) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4415cac8dd4c8e0ec6bd09640c44cb0N.exe

C:\Users\Admin\AppData\Local\Temp\b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
"C:\Users\Admin\AppData\Local\Temp\b4415cac8dd4c8e0ec6bd09640c44cb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
83KB

MD5
4f899dfe54f55bd34475ae181d82b32a

SHA1
86f93437bbfaa61d6a7d8cc44520a64c0f6ec2a8

SHA256
a3869a08f916ae7ae7686145779b2f6f5dd6aec2646bc13c3fa721da6edbffc1

SHA512
ba8063c16df586ced5b3ff034831e966a811dfa400f5a7ae41eb6d350a0e5bb1f7f93bef90f102bcf2f6d8032c60403d1637e491ed3f6a19882f525345f36b1f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
0b800677e7b9b9f4dcbcea7a625bfe90

SHA1
d2be8d8cd7dfa1f21c24983043bb2f2b4d0836b7

SHA256
6dbfe1796d1478e2fae4b8e394a6de20841e0d13df732c96b6b880e09f537244

SHA512
c4367f8eed10aeefc98ac29aced61e20c7ec72252b0473936550a193cd931a3dbe489bdeed400d415cf600dd9d8c066dd908c3b57ff1319605f0697b76f07b6a

Download Submit
memory/3848-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3848-848-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download