98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
Size

36KB
MD5

54435baf6a71490816c4a440750ad070
SHA1

868ae9edd65ef75347a0009616fd46d7d3d46b86
SHA256

98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979
SHA512

1f0aac5b9caa0b6a20ab83866a05ee8caf4ce1a1b3d0062869740043b3fbe29ddf0596b937de77bf42ce1c82485a6f2a9aed847a8e78918a38398600b76a72f5
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpKJ2pqpW:W7ZppApBULcfpHLcfpKewW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe

C:\Users\Admin\AppData\Local\Temp\98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe
"C:\Users\Admin\AppData\Local\Temp\98add37e825658e3cc2185b85cbfba9be46d63b47b0b850063ae93c03e2f6979N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
37KB

MD5
51471bdf0642efd7b8e6a92ad8a7aa33

SHA1
828100609ac83a0c9d0c50172e8a1037dce053d8

SHA256
d1a843e54241710872a6c797fb8103434c67555e3090c7b3491581006bf75a81

SHA512
b5ad106715a42745168c274bd553f23b16771adbc88114a4dff9d51308e050b5ed483228d1b5c54c1334a0bf5eb474332550f801572bf60e6d4d3c07b3c087f1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
135KB

MD5
ccc65844bb93b7ea5276ea718f528810

SHA1
245d363dc79f35fad192106a32a9bf63e97e7e15

SHA256
8808c706a043f0b9ce99cb901e010419a097297b7da5d8dd6b29efceb5e901bf

SHA512
7847722ab5b825ecdbf8a5c7666747f0a3c64d9fdb0d2060df3e214fa016e86acfe92ad2053ceaa2cd7437912e8b1278c4f791cab64cab19288af5f53971ab2c

Download Submit