a864999ecb033da011c7027c216f2485b82748d693940f344ad2e1736bdbb826

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b030a7859a3f1cda2faa8ecdc673e420N.exe
Size

72KB
MD5

b030a7859a3f1cda2faa8ecdc673e420
SHA1

3c315c42ed26a35d31e9442d4035997343402ffa
SHA256

a864999ecb033da011c7027c216f2485b82748d693940f344ad2e1736bdbb826
SHA512

1047094844418cd7283248cdeac0e0ec78861baf8386b4d860f8d92a2647df16c2e6ac614877b0f6a68c8cacb1fc16cf5418792f3eaed9c87ee211c7b7029275
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvUK2:6NLWpCZIzjwHwY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4234) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	b030a7859a3f1cda2faa8ecdc673e420N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b030a7859a3f1cda2faa8ecdc673e420N.exe

C:\Users\Admin\AppData\Local\Temp\b030a7859a3f1cda2faa8ecdc673e420N.exe
"C:\Users\Admin\AppData\Local\Temp\b030a7859a3f1cda2faa8ecdc673e420N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
72KB

MD5
a04497fe37e64b9a63bb8806ab96c030

SHA1
20a89e5a443a15c2a03a29b7ccf7b9b22195847a

SHA256
dc05af66c549d19c467806c4e0390b5889334e7bd2d4f443073fdc985b4da36a

SHA512
515a913fd07e1c3831107ea4b13e7c46eff617787385175555d6c90643ac015acc81d1ee33ea0d16e81d25ae5892aad8f388d5c71d4e7a200a7db9f01ba897b9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
639f76a7477d72cb80e657cfcf19b8d2

SHA1
b8b4971b69c78e7b1a779a284a44d5038ecbf19f

SHA256
a4336d4e34f46dc952cd95be0135249411bcbe92d918c02c7a1bce187b5045fc

SHA512
d31af5db231126a742aecc5d3782045f23212b66babb4b2455f1f7fa3c540fb902fd03482640b9083903ea389978cb08cf3947ab50ef26e00e8f73f47d5c81c5

Download Submit