bda3e07595e700cb326d344f7aa5fb5e3ba7c925bf4a17f026d3fdc6247af881

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 21:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23c0afa45514a85283afe3fa9dd59700N.exe
Size

39KB
MD5

23c0afa45514a85283afe3fa9dd59700
SHA1

4f096c32124e0919b32f7de88b382c0af145e537
SHA256

bda3e07595e700cb326d344f7aa5fb5e3ba7c925bf4a17f026d3fdc6247af881
SHA512

baf8942820e1c3cba6887c7009a7b40b33a9ad4455374014aae949009ce7fe4cf81958b48cb5f6cc618f17df2e86780f8ccecd0ab577898e188ebe3375b07230
SSDEEP

384:GBt7Br5xjL9AgA71Fbhv7bhv3KueKudLl++KR2U27F6Vi28gfF6Vi28gF:W7BlpppARFbhjbhPKueKudLw1M

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	23c0afa45514a85283afe3fa9dd59700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	23c0afa45514a85283afe3fa9dd59700N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23c0afa45514a85283afe3fa9dd59700N.exe

C:\Users\Admin\AppData\Local\Temp\23c0afa45514a85283afe3fa9dd59700N.exe
"C:\Users\Admin\AppData\Local\Temp\23c0afa45514a85283afe3fa9dd59700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
40KB

MD5
30ef3b7463978746af9f3ff2d019ff06

SHA1
ad305d90070f09a492731de64f71f9c6fdb0150b

SHA256
f04b747ba20d5c909340422616f1ddde75996311888bafbdcb57f829b2a8d0db

SHA512
1fc0e3888fea022531d0e1511846c57494cc5904ab7471601763306ccf689ebb3b26419966f452138aa22211ea8f68068b8e450f81f1e986d58c1b39d295ab6b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
54ed6cb81c3df448dd766ae5c1759b18

SHA1
81951cbd946401aaca1e95d8e41077cbbd201fac

SHA256
affb430926e3772c7f3cdd25510665293961e95d655c1bc220c90a1b9df92855

SHA512
08297892a0469ff9a6bd1c08c0b6f7860a80b3ab1aea2a23226c85096942d2fce723ab8e34818c0f792b3bd72cdc2efed8a68a864c19ae1ab2fd697ffd33228a

Download Submit