82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
Size

80KB
MD5

69ca70fcf8f9fd5f4bb84e79788d5530
SHA1

c0266214067d4e1987e86cec2f22697a372d1af8
SHA256

82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27
SHA512

ec90e6af7204590022fdd51058973f750c7f581e0e80bfcbaf7fd420c8e087697bbc5c6a7f5385b66e77a365e89f71e3d71051cd16878bc66549816e8c47233c
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd55tDYTY8:6+WpDfmRfmhJts88

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4471) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\ExportFormat.wmf.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe

C:\Users\Admin\AppData\Local\Temp\82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe
"C:\Users\Admin\AppData\Local\Temp\82fc87db0281bb61a919991f63839525508af712bfe086ebddf0276809e96c27N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
80KB

MD5
2cb3cd899dc7323259b9d75800fe9487

SHA1
43d376ae134cf49fcc56521227e2ff45e5410b4e

SHA256
5199232932b1a16154998edde60a5160edad9a9a813ff2fd6c2e90d659d25646

SHA512
869c478190c0148df6198755445bdfa04ea2e4f5ce6f8a314d868cdaf271cb2ff30942b2c4e829bad23517b10f831ed39586036978f1d678775fe371efdef2ce

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
16bfdc3389ecaa49ed91a2c5503ba5c3

SHA1
d2961adcef0ccbb8edb3474f18462642528c7e8e

SHA256
dfdc6566902156fe59870a636dbef81e98888e6f25d099caaa8317bb2b6118cd

SHA512
0390fe4cea23e8148e15edb037d1a87ec9f85f446c828af934789fe979154ea2fbfe680cc51f58a59c024037ba2b25ceb7b84cd5fbec3030d5aa4436db9212ce

Download Submit