392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0f

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
Size

40KB
MD5

6aa9bcc221358ba3a3f24c6ef42ad7a0
SHA1

4773b174b45846a92ef012256b042b1e3849d146
SHA256

392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0f
SHA512

dcf4bcb3cecb8b68aaf0cbb9d50481456d384135bed21cb467cf4459c948d1462c4cb04cb3c829795c3ed51cf65e4816aae9a16438f0c23f9f00bcdca8523c44
SSDEEP

384:yBs7Br5xjL8AgA71FbhvsKvbT4/Pbf89taJrcT4/Pbf89taJrK7V:/7BlpQpARFbhVvbM2MI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4697) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe

C:\Users\Admin\AppData\Local\Temp\392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe
"C:\Users\Admin\AppData\Local\Temp\392be4b653042aeea1e98b5e30aab7f3821e3772676acf19297f0e397f8b1b0fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
40KB

MD5
c1fffc772f1a7ac20d1c1e31fc748f2a

SHA1
7d2431fa993b7c34314edce079304c57902d32b1

SHA256
23ecdebd3a135c1d42e3d7775600fd0dcb08c80764707da6dd3fd59fad5a2d8f

SHA512
6aaa107b81701c30fde03d1779951b6cfc6d566233cdeccae27f6e2787ab9a11c734087215e03403f60b1559c38abb69d47f8e26f5ab4823f2a9813961cca46f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
139KB

MD5
d36a9b009e41833a8598ff7d70a445b8

SHA1
550da915b76fba20444cfd0674b2e17776bf7ed8

SHA256
c4d1af65641b53232c03ccac751fd323dd6b2cb8f39539839620925e4b11e528

SHA512
809b5bd12869f0014c42afbf4d91b098c6ce1cda03a13f40e9c5f4d1813b4436fbced87753c715fc62f29f3b7a91d55a7fd6c7d490e0ab4dec0dd664f17404b6

Download Submit
memory/1040-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1040-1010-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download