b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2c

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
Size

55KB
MD5

91467d8e8dc3d2dc605e809d3be0bd00
SHA1

c9128fcd471f53ed5a926ef9c524de9032b563bb
SHA256

b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2c
SHA512

750516474397fb73a9b398cc05a2cfcd2a502c5a78adcf10192eecd59bb5183326ee3d291e407a5fa27b70ed20e11dea46e59c8235db39628a7115681b9979ea
SSDEEP

1536:W7ZppApBULcfpHLcfpyDA6Uh3tS+AtS+QZVLZV1:6pWpBwchcwDOZVLZV1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Crashpad\metadata.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe

C:\Users\Admin\AppData\Local\Temp\b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe
"C:\Users\Admin\AppData\Local\Temp\b05f8c5552d76480c2967241ca029fe2f9c8bc87713b09b9ae7b454013695d2cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
56KB

MD5
f5e522f7f3abde99e1b8fba7d429cb70

SHA1
f84d67122ce821d1c5aaca0dbbf88955a651bf47

SHA256
7f0209eeb58960600f27df9f64aff7951c5076a1b38653e2beb3895c0944cafe

SHA512
dc60dc682c52503f0fba7b83e2947cb92a47738a6ca51d84db68d0c2b45804ea479f16557980bc968cfb2ff532d6cea07a5ccdf934003ff154bb187b5d8f18eb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
b756170a98433d84abb1af10d15b5f24

SHA1
76e5ee9c8667b34397627dc486793524abf979dc

SHA256
b0ed4bad41ec61479af14aed99d393f8ca25fc615423cd1a9390677e3c9cd4bf

SHA512
e78f42ae8e673dbdc5fc3e6f119fe4b1645fad83ea5dc399753bcfaae81e61aca0b9be01d570a8c52b8662b72c0d602d389c32f1aa1c615fb31e5224d4f3fb68

Download Submit