b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1

Analysis

max time kernel
119s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
Size

192KB
MD5

efb64f7044e94fe118b84123e2cd4470
SHA1

67912994a91031cbad312ef8db4860a1ca2c42ed
SHA256

b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1
SHA512

debced1a9c85bc6d389aae0b577f023f2125432f9409011dd840389da0f837d3904ef9bdd702e2852099ffc9af0e1a3c8e4311bf072dcfff0445a7e9b3b9d297
SSDEEP

768:W7BlphA7pARFbhKKVeIuKVeI6B/mC1cRk5O:W7ZhA7pAp6dLhO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe

C:\Users\Admin\AppData\Local\Temp\b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe
"C:\Users\Admin\AppData\Local\Temp\b182b95c9693fbebb28c02a57c3ecee6ac3288d9190c12d89ca7d4a2368535a1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
193KB

MD5
c386b98a0ebf7234732f22c0ad874fa0

SHA1
864037093ed9d22afb359eb53f6a50f5f270b241

SHA256
baf318be894e700d22c53dba23d9dd7e223d3efb2c5fce38e25bf499c7567cd0

SHA512
e68778d6d8e76ec25a33de2c482160b76d19561f141b560f54c04db9e4b4aa4fc0f5d3e4b395d81cd8daae05bb7c9b3f0277031e7072c63f959e9fb6f72eb293

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
291KB

MD5
ff57b09fc7d85db34dbb4493f5e74e64

SHA1
f22be923aaa8295324e0acc3cd3154fd4c1a247c

SHA256
5ac2b5f602b7ad4c1f3fd416d41f190c36a46ae55369be8a18da1cd7e3a05ae5

SHA512
a662f6138c1b589180c9cb3f029c043767c98992203865a85d5d2a07392aa33281232b50f9120100e2055b8a54f083274398cd7dff629327ae1eaa5cf84f87bf

Download Submit