bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
Size

51KB
MD5

3895763cd34f7399bb5ff95b90704b00
SHA1

d1209222c5008e120e4ae5c6e384c42dfe9312a7
SHA256

bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080
SHA512

20a9898ae58df326d73596ed56719075fe78101f16b29e1899b7ac73a4ae541941a5b928b4c4e29f4583020d45fed9357f67b2fba9a12b0250587d37353ce647
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6nZ9z:/7ZQpApmi6nZ9z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe

C:\Users\Admin\AppData\Local\Temp\bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe
"C:\Users\Admin\AppData\Local\Temp\bcef8b11ab2591abc5d2a99868b32cffd94741b93296c6248909f577566ba080.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
52KB

MD5
96a2e5c1dc824dffd6161326534a958b

SHA1
d6eaef6af547f7543a56cd0ef7c57676b88a20b6

SHA256
85501610015458641cdafb25cfd336743dc4541e5b2011197323b9d1cdc448de

SHA512
0b8389e315a9879188bd98697bd4c9216a1371cd5c6dd4401643ffe777800ed904f097bf8b72321a0cfc662bb386e48ffe3498f97f485739a0761cf06bf84456

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
494b194e540b3e43cb241bb04c08a437

SHA1
0361d5928a1688252d7888ad0be2f61d8ff55160

SHA256
d152af6cd61ed90b67056f0fdf6800793ac09e4a3c7449e6ef7f88c6b9f027e7

SHA512
51afc2e69f4490a72ab8bb4d03b4124fef25c0755c7edd4a910410cbfd2a8d74980cf4eed6ef924f84abd448f56e87df1a95289f0dd0e9df81710b8798cc0cc8

Download Submit
memory/5036-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5036-898-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download