273934eb6aab75d6e13a9076c04d683aa3482c0dd650bb7d080411e13ee92836

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
Size

42KB
MD5

8ba8097929fc016fbfc8bcd2be5dcbf0
SHA1

67376ede7b73eb81aa0608bc13b7b73a4c40810f
SHA256

273934eb6aab75d6e13a9076c04d683aa3482c0dd650bb7d080411e13ee92836
SHA512

1a1ab18ec3463f8384c6ee7d03abefe277b5237a457e495d96ace11de47719775c56518e731f3890ead8c8828ebc3637417507e87664a5d393e8165747048af6
SSDEEP

384:yBs7Br5xjL8AgA71Fbhva4S04SXvE/1Mz/1Mq:/7BlpQpARFbhS101Xvz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ba8097929fc016fbfc8bcd2be5dcbf0N.exe

C:\Users\Admin\AppData\Local\Temp\8ba8097929fc016fbfc8bcd2be5dcbf0N.exe
"C:\Users\Admin\AppData\Local\Temp\8ba8097929fc016fbfc8bcd2be5dcbf0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
42KB

MD5
8670e896b160a609036b6ad8e8e831ac

SHA1
4a546030e90b0208ff6c6da7e42fdc56e65a2396

SHA256
ce5c61a0448775c70c06993e80eb31945707cb876904856142a9c07e52b1cc63

SHA512
ed07f5f902edeb78823e8382955c4b3b24797628c3748dec682f831b1a37b19df7de6d5eb883e65a2747c6c30924bf1ce6816764d81cede2e749e750cd88c965

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
7529411cb166d5035c5e9c605a2f3674

SHA1
d391982cb192a05026ec7e4207323866be400642

SHA256
9d83be8aca9890db7e51e85ba19926e6cc879b5435940c835da7cddcc88cd41e

SHA512
0c586e3955c0cdba7b7908e2e17e748279b5d0bc7a83b2d170e04ec46052bbac3238ea706653d86594c3cc40e8338ecd84fb463c80d8393c9d9e5aa0421d7adb

Download Submit
memory/2836-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2836-902-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download