a7a1c58c7ceb03717bd03913dadd5f87f382e3b41ba7a967781a31c3b6504ceb

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5857c4883f0c83704c4bcd7486d45180N.exe
Size

39KB
MD5

5857c4883f0c83704c4bcd7486d45180
SHA1

a4d2e69b6faf417a0a213c99db55d283405325ef
SHA256

a7a1c58c7ceb03717bd03913dadd5f87f382e3b41ba7a967781a31c3b6504ceb
SHA512

1a0968b701ccdd492abe9a1440651d7c1deaf81da5b00a0e91e565cd7a24e57d8ca8bdf81d75877b54c36d3d4a40b612d6def0c46f31a12cf82dfe144c156427
SSDEEP

768:W7BlpppARFbhjbhQYjY+WyKoIWbsHfySkT5GeQbyi348oWc1RPOzkjId6q8UdrSZ:W7ZppApBMyKoIWbsHfySkT5GeCyi348y

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4663) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	5857c4883f0c83704c4bcd7486d45180N.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	5857c4883f0c83704c4bcd7486d45180N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5857c4883f0c83704c4bcd7486d45180N.exe

C:\Users\Admin\AppData\Local\Temp\5857c4883f0c83704c4bcd7486d45180N.exe
"C:\Users\Admin\AppData\Local\Temp\5857c4883f0c83704c4bcd7486d45180N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
40KB

MD5
a124ee0fc1245889f5cec04d724e5f7d

SHA1
a7909820454d1015f1500544c81e4cef855d623a

SHA256
af8beddb743441a116679540a5e9cadca777f8e1da2e290753244b12b62bc999

SHA512
8cdd4edcfe861397add23e8ba424111e70b594cffc95c460254cc0d2953967d4ef9d24bbad316cfa4f159bde1bc781944344a898b85fa879b8252c2c4e878360

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
71d41eb75d3821e8d40698843b20d0db

SHA1
9dfe5a5753ab4ad9063c2f8d406f47701bed54de

SHA256
4d971d1019ed544d05edb7e2ac8e055d3e15d79d27588121499c90d4cd75db1c

SHA512
cb2b228e2405bbb6b0b63ddc56a4c85c8f84f336baa7ab99d8e4e1730cf2806e237b9022d38c2989f9c9b676322728df2b2f6571e182fbd8102120fa358cd010

Download Submit