be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
Size

52KB
MD5

3b1fab5a8a11bcb2e83477110d069380
SHA1

776ee1b4b5516669a7c620e9430af44a14be0489
SHA256

be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96
SHA512

d595a841fd7f9b8d09326adc06b8bdfda33c5a466c3b17100e1583df592cf32f3654580e4a2450e55ac5519f3fc5d737fa3a94e56efef928ad77080ccf371735
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lz/g6sHzcXHzcC3OTHTQZ0Zo:W7ZhA7pApM21LOA1LOl6l6YzqzV3h

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4658) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe

C:\Users\Admin\AppData\Local\Temp\be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe
"C:\Users\Admin\AppData\Local\Temp\be5456a7b58e293c197bd4f0765f02d03f51f1706d9ab8b0a400c2be60229a96N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
52KB

MD5
2e9d348d55062b393a6f536820f6e60b

SHA1
f57a205947e9b346560edf6970bafb55f08b268e

SHA256
b2899623ab6a8ba90c126b5d6bda7fddbf71375f50cf66bdc175728de139407c

SHA512
84313587bfbda652a83de79ddc67811b16aae1b8bd6f25109b5f469aaea9e8862d9ec7d19cfbaadef31d86b9dee76f74a7f5a172f32ea2311f171556952f6a92

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
758a30719b213294738982fde8e02c8e

SHA1
5672564fbda50ae94520845f660f26e64c0ed138

SHA256
0523a1f649b722df3889b65e85892575aa5b79e336464a72573dde70437f37f0

SHA512
5068b8ff099e3dcd445c0130fd53237c3107be5b4c554729cb3dcadc4d909f55480459050ea833e301fffb760655ff7663707c20664b467cf0d30fecf05ff38d

Download Submit