55bab5d1b8c2947322b0ad3aa9a45bec8eac594a82eef6a800714714bfb4a2ab

Analysis

max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0060aacb023236a897fb094a71fc120N.exe
Size

98KB
MD5

f0060aacb023236a897fb094a71fc120
SHA1

ba1953246562dcc2abaa1a45e73ee0bd09b029fe
SHA256

55bab5d1b8c2947322b0ad3aa9a45bec8eac594a82eef6a800714714bfb4a2ab
SHA512

ee4c794cb6627924abe58ac83c19f9ee3272c9ce8869d353dd7f0f13d85282208eba4a238be8ec1f49e1dd9d9ff0b3c4fedef6c69281ea0cb83301ca547cf88f
SSDEEP

768:W7BlpDpARFbhYQkQjjIXYvPXzWPXzK3733uF4V7en5c5HChCrmhyEXBwzEXBwuqX:W7ZDpApYbWjIoPyPoLzV7c6Shw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4309) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_elf.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fi.pak.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	f0060aacb023236a897fb094a71fc120N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0060aacb023236a897fb094a71fc120N.exe

C:\Users\Admin\AppData\Local\Temp\f0060aacb023236a897fb094a71fc120N.exe
"C:\Users\Admin\AppData\Local\Temp\f0060aacb023236a897fb094a71fc120N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini.tmp

Filesize
99KB

MD5
76de588eca10dc1b3f80a8b2fc45bfca

SHA1
83d30e1149fe7d794629e63762125c243f8d2f47

SHA256
a7ad72b00f786a5522b5bc66783a33f2ad4225ce77ff6a7b8430b3c1c237c292

SHA512
24b42e47ae7c9451408276ffbf892480d3d8fc060338cbf6c39ee4d4d4d28f9de08d65caf3cdf8399413f537ab262f7aeaee876d8c60e7aef3ce591c05ac3cd8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
197KB

MD5
9f69fb50eb196db7971b3b208521314f

SHA1
9cca0e070cb4235572d7a83a586472a7e5dfd935

SHA256
4152031b733270356f4485aa51a09c91e1a046ce1dbdf262f434f9a36d2edfd5

SHA512
902684ee1c8a58ad9bfa0c6dd36efea7a751109f400f6460b19d10419ca07250189951a577025ca2e6292f3e681ea2551d87bc5ba831504c5a0f0f8d82d2abf3

Download Submit