ec184200ff8f0224f6ef794690c7c95c9ea3a78cacb8d0da6c27f8667a3f719b

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f711433acd988daa2358f0424d513f00N.exe
Size

47KB
MD5

f711433acd988daa2358f0424d513f00
SHA1

4075321fab4306f9bd612f0e5dde6ad2c6b4bc75
SHA256

ec184200ff8f0224f6ef794690c7c95c9ea3a78cacb8d0da6c27f8667a3f719b
SHA512

5fd056a10b0a2fb01dd4a5fdbbb7aa57055b1f1c32b08e922769a53ad2d1fc5b59345e7c77b8a93b622a4c3c721e3e50bba1e3a344b18ee5bd300949ca8b17d8
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0Ijftf/xDxBjdjl:/7BlpQpARFbhNIiJwsJwwnZtRb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4182) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	f711433acd988daa2358f0424d513f00N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	f711433acd988daa2358f0424d513f00N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f711433acd988daa2358f0424d513f00N.exe

C:\Users\Admin\AppData\Local\Temp\f711433acd988daa2358f0424d513f00N.exe
"C:\Users\Admin\AppData\Local\Temp\f711433acd988daa2358f0424d513f00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
47KB

MD5
4b6dff030acaac0f729a676c34927917

SHA1
f6c2b9787748602dfbb8c5faf88f4e9a6549225a

SHA256
4f3c8d0a1b15e820c82783a976af43264a7f60fc964e3c136e5f70ce2ac2d8a8

SHA512
f63e7f3d37c251977565df31124255a9e56d7c5e6d32974b2a9273da3e0c6e449f04ec3829d61e187f159dd3747c3a2b7d34936054cbcb46e2804502ea16b262

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
cc1aba1c43a00c595546142d01d1cfd0

SHA1
e37caa4a31fde220763ed69f03df5bdfafbf2e6a

SHA256
48e93faaf4679c32b58923854cb3c34d7d8e9220c924fcc58f404b7dbe486ed2

SHA512
1cf6201c1271892d4a9b629f30befbb0567a46ec2a4a7faf42ccb023bc907d3c206fedcb5c489b129d20311f04841ee28b54e8033fa92763991b638f70e3da75

Download Submit
memory/4860-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4860-784-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download