328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
Size

42KB
MD5

255911de74756ea286dc684db78bd450
SHA1

11d11069fd445b1a6ca1dd47b2b60fb598e05ea9
SHA256

328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041
SHA512

1aa453cc7f2d8ec2b59ac8407a58fec92543bb8fbc229bd372b9f9ac1133f1df0c2fe3629ecfa02e7f911704108328e9a8e27a209a0a55ca99022939951aed55
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7ChzVB:W7ZhA7pApw03vR03vuh/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe

C:\Users\Admin\AppData\Local\Temp\328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe
"C:\Users\Admin\AppData\Local\Temp\328f1be945f46d0effd664d5ef8bbce2b30a09b6c9b5329093b701e27fa90041N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
42KB

MD5
aa0645c71f31d1bcecbfa25884bd5741

SHA1
90c0bd79e1988d07663cca571e470a849ab563b8

SHA256
dfb5ff93c63c824262bd86cbf50bc991fa1059f06a24599dbb5175a02029929f

SHA512
3d311bd503fd441e866e4ab56021e03f7ffc7eef8e54ee83c50c520327b0cdca334be6e9caa62b0219d4dab67d3e21bdd24c7e28bae0ee7d4b26bfe6796181b4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
cdc2b7d7a1649c6c26b4f02bbc320e7a

SHA1
6b251cc57524d0eb1504b07852502d13ddf9dbba

SHA256
95b433cebf84de0f6f8570292242eb93be4c5a545151fb4d2f8a128140fa1a52

SHA512
00627f052a78c813c7d8cf8c8249d4567527b03c9f0b69d8539216e9ba3172f7693caa178359f524e15335be0c79246904a0767775610ce650242d1108803fb4

Download Submit