12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
Size

52KB
MD5

1f87a34018d44f1c7e8b29ec80bca4ad
SHA1

7969582c64a2a5736069b957f6063759745e6ee1
SHA256

12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7
SHA512

9c55e0a9d297f4550895196f8882876135cd5412ce22233069bce92d50a32d5f04614207b7b42045c485869de59353adac4f971a41fdae12d85249c7c7835a41
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPqAlJIqAlJVU6crC:/7ZQpApze+eMU6T

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe

C:\Users\Admin\AppData\Local\Temp\12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe
"C:\Users\Admin\AppData\Local\Temp\12a465e0e940d9ebaa0b9db57f20a06b83956d7e6c5b4765c0e83e8e06c5b9e7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
52KB

MD5
e8412556208026ff3a64c0c801d4e0af

SHA1
a2796cb66bf49d60c298f4f795f27b763e60dc61

SHA256
517a33fb23645eb0c38e5932fcc17c4f44639b2d229947e4ae031c6af4c48ef2

SHA512
a7ee0b28dd57af739ff98ac2493e87af7ff3f4f20a8a4543bccb7734ce3cd2a4c7ae25fe059120d2f4303e2306390004a385343c5fbcfe0e770935ab89e9bfe6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
c6b2e2a6f0460814910dfb5e81d9bf29

SHA1
f6743c635b946a1e73fedb5ad89ee2bf35e8f36e

SHA256
1ae14658248b29a2f0003e91a62c0aae99cbf17d52da5f2609d4540f0856517f

SHA512
288093fe608533ac0ad8352f634023acfee922a9bacb7ab864aef328e73c253c5e5dedf1f46b144937689334a638fa2877e21dc98c9e08751e07b47cc77d24d4

Download Submit
memory/3376-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3376-1792-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download