bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49d

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
Size

44KB
MD5

cf1fb2905daff5fbe576a6f05af68540
SHA1

ba68999d98a81be6773e5eef062888d24e7260f9
SHA256

bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49d
SHA512

2b5aa7994c39263e79e38fe6c9a27b4f3061e00badc8b5301bd680178ea7fa19878146b3961187d173765882fc56249e669c480d1161e3528e2f236216f98a7d
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFZPsFhiXFhiozlAJdxilAJdxi:W7ZppApBULcfpHLcfpyDZPQqrF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.exe.sig.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe

C:\Users\Admin\AppData\Local\Temp\bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe
"C:\Users\Admin\AppData\Local\Temp\bca0273436509b3fa8e9c2c771f067bb7125cfd55522431b1fe674813751b49dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
44KB

MD5
3a5b2a3af6c1bd99db7b0af6186add0b

SHA1
f4d6793dbf91db87f48d6009485b22edb2524f93

SHA256
71f2e59be72c4b62a74a8e7449bfbc3b6047396208808b52d96a1408c8870a4a

SHA512
3272084c89378f81e5b48e0ffe859355a69cf78b91514d3e8baedc39535211e0f8744a1cc2558daccbc51850e3a1beafe23cee7a23dbdaaa43bfffda1736cb6f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
887a487c5b9fd80a2c3b9bf82a5beaa2

SHA1
67cc1c125207b60d37ca94495590e6ce0f7e44b3

SHA256
f26e1768d9d7b9e5982cd23639be122f5633d7c929f0d44e9632b336d4ab008b

SHA512
a61103d34418cafcb9e40141dc07e7c347fa8be0de7c1cfaf5dc4684d3064aa07fcdb55e0077b85e99c2e062dfdc83be65d86f2f1f48d450a94573ee0e96053e

Download Submit