11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
Size

49KB
MD5

2f21b3cb4d70101dd76c44e58ca7c390
SHA1

0cbb9879857abe2d59e5c933b89160f720528907
SHA256

11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410
SHA512

c735cd2e3d5008a17c09a791708b1eee976135573aa6a7cf24721949dde975e78a3ba91cb1bef56e0939ed0c5310cde3a5d51e2106200cfdff9838e82f09d8be
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c5HjF:W7ZhA7dABJJZENTBWv36b

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe

C:\Users\Admin\AppData\Local\Temp\11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe
"C:\Users\Admin\AppData\Local\Temp\11bfc7f4b60c93425186f364bd650ed70faf84af50c2ded25a1f2abd2f719410N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
49KB

MD5
38519cd7b1ac3280d0914b05fb9cb024

SHA1
49c15af10fa65041a0c8d5447ada65484634b651

SHA256
489c15447a86cd72b8976949be4c71e813d739f21c919cbf8598cdf826c711dc

SHA512
f3e4c2c87bc85c5cf1f09b75ea92729a0ed46ecd2c22dcf2bb4ff6eb59f1d314677a1ae0b5629fb8ec8c6cc742f4fcb6b5bba1254184d46b6ce709710663fda8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
9dbf345e9eedc21a37239934a8fa2aa2

SHA1
13e4cdc1d0dec13478693b4ad3e8410c68f46db3

SHA256
ea7695ceab1fac17ce4af7840cc93f4dd46de603e181d17edc5bfbf481b23dcf

SHA512
d0496fa2303ec65329a31a337f1a71942d00e57d3912e55d81784ce1fc2b507238555766a56ea209053516314dc133ca2d0ff5c5a584eb8f9b3aee940d2125a3

Download Submit