605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19b

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
Size

46KB
MD5

a4eab74696294bfd9c4d20ff570cec30
SHA1

325eb0e75325268fd6a1dfa65fbaa85e44564481
SHA256

605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19b
SHA512

6e28a17a61f16f6d66435f7e8020b490b3e29b9806c90c8dcd8cf42a0f13999381c3839449d7a17e7914da655b4c161fc0e02e588711f5a6dcf64cd2541b2ac1
SSDEEP

768:/7BlpQpARFbhNIiJwsJwdXo8/O0QJfo8/O0QJh:/7ZQpAplJwsJwdBcU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4383) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe

C:\Users\Admin\AppData\Local\Temp\605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe
"C:\Users\Admin\AppData\Local\Temp\605009e003f31f05f726e28cb98a00b6085da817edb2630416e9f3679c2cc19bN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4264,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
46KB

MD5
d739cafd4f380c33f84c6f3891f2e146

SHA1
a3cd2a7f41743755b64dd685edf4bc6fbc932289

SHA256
9f255922d7050d6f3144a0ec3fbb5b0409bdf585f23fc6b145fef7602cdd9e8c

SHA512
c559db89a9acf28ee1c40e56564c5a0f2263757533a9d02ab502e9d79af718754c69d698024b2e690b8826278b3fcd382b68ae47d1b4c6384933de3944747d8d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
159KB

MD5
6201811dd942dc365027e0598a38a696

SHA1
ba59755dcdc6a7a3033335162d358f83fe03cfcf

SHA256
8fb1ca469a17c7012294d7ef545c42c3265880e424dc70950aadf603d8bfb78e

SHA512
10bff2d687fe0ed51dc10d58e502f237f620711aef7ad8e7296fde7a0b5ba5d80fe36b712241d6bb106c6f16279bf85e0565e0fb5643b9ac3631963713b94074

Download Submit
memory/4964-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4964-854-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download