254f40e08e66e263c0b74504d5b66722479dbeb0beccfbb814df9ee70cec0fe0

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1bc2f714031ea6abc20da8197df6ca0N.exe
Size

99KB
MD5

b1bc2f714031ea6abc20da8197df6ca0
SHA1

66efda94508d7ff05cd24abf47a11ecf46988902
SHA256

254f40e08e66e263c0b74504d5b66722479dbeb0beccfbb814df9ee70cec0fe0
SHA512

767f1e65b0e02d3cee033d7a7c69600d628cd7d6d8c484e5ac7479c0c6b1684a40cd6ca72f3464153d6645411e149e00a469f6939bbf532665b1adcf8cba32cf
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUf7XQex2E5f:69WpQE0zUzXv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\ImportConnect.dib.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	b1bc2f714031ea6abc20da8197df6ca0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1bc2f714031ea6abc20da8197df6ca0N.exe

C:\Users\Admin\AppData\Local\Temp\b1bc2f714031ea6abc20da8197df6ca0N.exe
"C:\Users\Admin\AppData\Local\Temp\b1bc2f714031ea6abc20da8197df6ca0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
100KB

MD5
d2d54366c8614e076080a1cedbdd5158

SHA1
7233cb881cdf6a3374266668d801d252790ae4eb

SHA256
3e48fb6c8069fbd5d8c58f6da190f77c074db6dfd231e7c7c1885f7c5a23508a

SHA512
1697cac209be47078537708eb98ff8accc84e38e69d39c55a08961183006ada2f7aa4b4f23c6cef8035b5f99d254e812f8730804601d2a1780fd5766c2e84245

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
198KB

MD5
f73a7a72826fcbb1c71575099eb9b2f1

SHA1
68248708f194a9e33ed7dad00775094bef6bcd2f

SHA256
32f0e51bda2700eaeb03502033a30a7d58192e7d3e16a50aff7b56882cb2902f

SHA512
202af3b3ad84a79d3e1435152ae8433f3592c2539e31c67fdfb9428ff6a7ae39f4cced5bef7226a673e8ba5f645d9609dce11d0101a4bac7c66bb5ce16e1ee28

Download Submit