1d40a77f47423f64bb95b4a88de5a485d1f1bff325a521ce3f7e1b620a751887

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46315dc21511c941ef12217fbbe11b30N.exe
Size

128KB
MD5

46315dc21511c941ef12217fbbe11b30
SHA1

4fbc564d1bb86cf466d69d3666b210b8958fce33
SHA256

1d40a77f47423f64bb95b4a88de5a485d1f1bff325a521ce3f7e1b620a751887
SHA512

d13343073225a38f2e426869304fe2359d779af58b9bb98bc3a6048fc3b7a626f5654a980b1ef81c4816515c5017f87910d055ee8b435ec3ff52ea82d4095a25
SSDEEP

1536:W7ZNLpApCZrzLDPWGoPWGANdNykTBlv6Bll:6NLWpCZLBzHl2ll

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4307) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	46315dc21511c941ef12217fbbe11b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	46315dc21511c941ef12217fbbe11b30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46315dc21511c941ef12217fbbe11b30N.exe

C:\Users\Admin\AppData\Local\Temp\46315dc21511c941ef12217fbbe11b30N.exe
"C:\Users\Admin\AppData\Local\Temp\46315dc21511c941ef12217fbbe11b30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
129KB

MD5
c5d777efe6779e12cc28e4c4014a4465

SHA1
09cc7afc26a969a4748b40c9fb9a0afe66d994e7

SHA256
58310e5b8aa457fe56ce4e6aa1347794e146cb4468f26b77b906399a5d6e6d48

SHA512
75c854c95c673267b426f172995c1938358b8ff1d0491e95c1b4cf5dff8a22039ced21aa767b099af2714e46d44db3241556f2451356ec01f5d0fca9296ee387

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
241KB

MD5
104f4df50574b78740bb8f0b75903408

SHA1
fe609201a90ac7aea2ff7176a2e3fff620dc19a3

SHA256
56bac59c77fcf0925b88dd93bf1d407caac91d678b027da7611e30af706bfb59

SHA512
81a628c9ad0dbeb6566d41270860a6f16f4e463b3f242c2fe7db90b802cdf674fa74b9e1ca33bda5c7b2d28998eb61735c3371b10a462215253e3f367eb43293

Download Submit