bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
Size

41KB
MD5

107fe5501e6442465221c08ac32ddfb0
SHA1

7b98b1acdefdd2b2e7044cefff8c65e969cebceb
SHA256

bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62
SHA512

455fa9209f0ab1c05d7251d41b71c7815409ab10f5d243df6da64653a39229ae565b6ef0cf926546201779d08ebcab48aa531da12a33be1bfa666d194bd06f23
SSDEEP

384:GBt7Br5xjL9A7AgA71FbhvnwR/s4Nkq81LOyq81LOUqKqeU3cLUA38gdcLUA38g0:W7BlphA7pARFbhM0Kkq81LOyq81LOk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4685) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_wer.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe

C:\Users\Admin\AppData\Local\Temp\bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe
"C:\Users\Admin\AppData\Local\Temp\bc27dca2466418f144e2eb96d0bfade02979e9a59bb2d7af9648c25529b14c62N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
41KB

MD5
a46d981638e6f1f1607c567485816f70

SHA1
53b700871d45016b2fa7e32aaa17d500b61540e7

SHA256
fa153b0caec634b3595181048d89e6816139a4d0671888534ee3beb6d1317ddd

SHA512
a7a2340e1bc2d73539ad5032900329c84586c3525e988d8d8531a0267257dc20432aab654365bcbb33450f61b20448baa82b597e3640f770b2270aa92a29fbda

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
3aacb25d7844532d6d7b70404951264c

SHA1
09b7ad8b31b31491da96a7869fdcd955f3551c23

SHA256
85b3adf6cdbd375fafb6b6e37421812009038ed72da1ccd4f3797873ea053f1e

SHA512
553fd2d13d2998e8cfcd46f35ef210e04c2ca444046d879aea74a5129f5b183473ede4e1e1fd0c1f32934b3d142e96d913e92e4d85813f38263a30b237cf93de

Download Submit