aac367ebb0a7509c9005ad105631f7d908e1be09f1882b85e0c50cc44de9a73b

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d123016c1e146edbce54643e4d03db0N.exe
Size

72KB
MD5

1d123016c1e146edbce54643e4d03db0
SHA1

3fdb3a4d94ab8b67e366529d783a7fe7300ae92e
SHA256

aac367ebb0a7509c9005ad105631f7d908e1be09f1882b85e0c50cc44de9a73b
SHA512

1b0894508788bfcbd8fdf6263d856d2415014d1cf2ac6c922aeae7694b9c03b9c6ec2a464a6816ec67c6aa5c9eb7b32258bd53280273158ff9b0385ca55c2092
SSDEEP

1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8Lv057:Te76WQSo6vs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3519) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\libGLESv2.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	1d123016c1e146edbce54643e4d03db0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d123016c1e146edbce54643e4d03db0N.exe

C:\Users\Admin\AppData\Local\Temp\1d123016c1e146edbce54643e4d03db0N.exe
"C:\Users\Admin\AppData\Local\Temp\1d123016c1e146edbce54643e4d03db0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-47134698-4092160662-1261813102-1000\desktop.ini.tmp

Filesize
72KB

MD5
bb7a92853dca4ca2f45fa76ced931e0c

SHA1
92230c81b9acb7397a213722b50f84f68f73cff8

SHA256
efc04a325a39ec958ca4240d67b3c2ae08a54fba431b7e07bdd049ca8bab336d

SHA512
bf9499b1f6fef53a2489278925fec2782eed5ce8927cc39f7bffe9c33bd76400ecc1ba9c86369856f113bdc4a27e8ba3a2a604084c5c121db505367186dc2fc7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
1e76fd3eacfd175b178605f5d72792a0

SHA1
88e1ca1b4230d63fba92bb47e89e6d38ef6c836c

SHA256
ff7114c9bdd4da41340f8ed37990240330af9587d72ef48be4222b024da2debe

SHA512
0d41061c5b5552fb25a5f006aceff769fc1ae2df325034de61d7c9be96a0aa4e69a1533e4369383bf30ffd420c55c172ff4eabf5ceb52ec352b50375e87034d9

Download Submit