315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
Size

94KB
MD5

60434b6922f9c9729af1e0f188be2060
SHA1

48cda778d91eab16384cd26b43c5cc3e134447e7
SHA256

315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04
SHA512

4fb1b3d441b3581ab8bb4ba7ef2302a63d4b037b92908de7371ad90b1fa8b8c5ab463cffc5946a0b74da8c4f4a0bccda1041862fd04402732eb9745eeec4e25c
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYjh4J/e8J/eYTC:6e7WpMaxeb0CYJ97lEYNR73e+eGGW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4382) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe

C:\Users\Admin\AppData\Local\Temp\315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe
"C:\Users\Admin\AppData\Local\Temp\315e283c6eebb51c560bac601e1a2cd111f444d4341813986272f2a9ed4b8f04N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
95KB

MD5
37a4dc4a1cb8174158f39eeede4bb1c2

SHA1
5dee121f7938d3e4d251e6e3c5b2d5276a49a230

SHA256
4b89979d7efa32bdddc5528ef1195c06c2c5760aa36800892f2af578f4fa52eb

SHA512
b049a3d7eb656da9d36e949b992bd5127db84d6f13a364c5e5cd0934e55da0cace9a0afb2972a535242e711f0fa839f5af8e3211eda82febc3b7cd8045677817

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
193KB

MD5
bb7e41bd17ae6d214598396dc165edbe

SHA1
9eea775f60da1a3e22f1086bf246a2574e45f90d

SHA256
1455238d332e341258305942684b61f07f6856e3ad1f39b096f5e9bf7b64ca81

SHA512
6bb5150aa6faf4c5c6cd36ccc4a8904e036517bb00e245a08dd4e17f901c1c2057834d789b9422dea44a6ca5b5b1d6d8897f1bc9715dbcf023cde87ef067188a

Download Submit