287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244c

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
Size

87KB
MD5

bbf40dacc380a7dc49ae945a7b68e410
SHA1

07a0fc23c58140a04a25528ce3f90bf3e2933de0
SHA256

287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244c
SHA512

c12420aa128f548c68cd08bac590a985b3f9b54706ed02b4c913f62aa37559bea03a4203a81a4f89be79160c0f3674a113af9123cdca62c40781d64b3b6c8960
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhn:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe

C:\Users\Admin\AppData\Local\Temp\287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe
"C:\Users\Admin\AppData\Local\Temp\287fe28921ff972e799bb2b9277fc0fbefade89b7d30bce4ea3e927c33ae244cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
87KB

MD5
d16e512dd022350969a67f33c3e72e26

SHA1
48dc59f4118cacd3d0d2b3d48970480c6315ccb2

SHA256
701b039ae642384c0803c8d9e6ff88df399d87717195424aecd9f7f77a58a88f

SHA512
70fa8ffb23d2c5b6d7a2f13eedf10b2b9aa53935808f8ee003212bd434b1c793fc0f3c1fb30fd64c230520b5dd44b0f2e24ed786533b45cc5f043c52af4f937d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
793e17d292f739f0bc78e4f932aa73bb

SHA1
8d877a27ed78eb322c1973a5df693a60e1ff4abf

SHA256
b1cc7d53222961d1d76ce6b4472fbfb3e62118d555703b86829fe3116af15a8d

SHA512
5699c6ef8165fa2dd72e8847af4db95414131a7960ebbd398e1de30c6a78eee178aa1ef9218200cd33d53d9b06a48854ca08afd23e2acd99c0deb22a6bd82e35

Download Submit