b549109ad1f88d1a56c532fc082c08745cc951be4525a64deea548c0f53d9962

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ce77e1e407f086d9c83fd39e097b700N.exe
Size

80KB
MD5

7ce77e1e407f086d9c83fd39e097b700
SHA1

240c74db7e0a6066351fa9ba64c9db1787898fb3
SHA256

b549109ad1f88d1a56c532fc082c08745cc951be4525a64deea548c0f53d9962
SHA512

28cabf837bf110e05d3f6a01f2636dc06729e2c5a7c8fa4ad026dcf5ced9ed59ba578223a5d71a2edfde41c1fd30b5680bba270a2410cf2ec5d080f93cba105c
SSDEEP

1536:/7ZQpApze+eJfFpsJOfFpsJ5D3mdG3mdGZ:9QWpze+eJfFpsJOfFpsJ5DZ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4305) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	7ce77e1e407f086d9c83fd39e097b700N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ce77e1e407f086d9c83fd39e097b700N.exe

C:\Users\Admin\AppData\Local\Temp\7ce77e1e407f086d9c83fd39e097b700N.exe
"C:\Users\Admin\AppData\Local\Temp\7ce77e1e407f086d9c83fd39e097b700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
80KB

MD5
3e4ec06eeb9ae8bc2a21d13a96f798ed

SHA1
a3aac7dbe4353d27c68454ec370a0286c2322d30

SHA256
d1565636dee83862e6027fac4ee283209a84e28c7baebd590f08316f118440e2

SHA512
4fa8dbb9193a3bc531cb866e23ba2b43d1b78e3f0a306c36ed1e8ba4810c0f1f4751cab870fdda8064efdd719429e3e9da3e878d0168bdf229cb6f787dc49213

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
c58a7a2885844470a72a92d45f92d857

SHA1
2039c2016968d17001ebb4929d1da441156841f2

SHA256
056cbcf1517e20af961b8fb8351591704ac142692897b48f46a4ee7363f745f2

SHA512
89eb8da6ade485df8ad0b5142a072951ae1299719c506ba17eeb380145a9e1a59ce79837228c721557b391d2cfef0948f92bb6451b729f1e7036635e17a49add

Download Submit
memory/744-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/744-806-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download