228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
Size

43KB
MD5

e24bcb86bc139a4c02509e99d33baa60
SHA1

d4a41361c25246078dc00a906fab242076776179
SHA256

228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80
SHA512

7bf6f8afad7353727d343faa36f3aceb34f2264dc5300c819c36b1a1280dba4843aaffd172dc392f5e75637633a0ccff2a7d5266ac57ed29a7e54e039c60da5f
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5qrVfZfI:W7ZhA7pApM21LOA1LOrtkpt6UrE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe

C:\Users\Admin\AppData\Local\Temp\228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe
"C:\Users\Admin\AppData\Local\Temp\228310effd406399e1963e44ae2b927a125aefdedbec708d6146b4b40e767a80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
43KB

MD5
23cff15bbfe98195fcb4a178c56e3949

SHA1
b27075847d665785f6adbfa315fb29eca6325155

SHA256
e99aedae0544a8387b1710929383e1cd169df26b53b5c536dfda270e98ac6a01

SHA512
4a993c679b3cc65770e193e1c81c67d5ab6015e71ba09735a23ea2e6e8029bb662c3ea4413bbaebbb3f865924f63e124ea692b74f0609ffb2fd2b679f55619d5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
e1f712c67b026f0b79d1f2e7ddf56ad1

SHA1
94f326ca4a5a3181107f5a01465c7d99e6fa694e

SHA256
bd51d3e58c0014da77750346e1935f1ea0a6398c108fcbfd91f265c7dd874ac5

SHA512
8ae89c8e4fa6f31d2be96ff17d94934dae950f6e081210824eb692471864caccadd7ee5a31ba080016e2b2c925649f0f80019181ba18a2dde9777e6037b4bf03

Download Submit