1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
Size

99KB
MD5

0f49d23cbe24f653294e5cd08c4c8a49
SHA1

1be53840e050e8384f03fcd3961718e8674497bd
SHA256

1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4
SHA512

d47b17168aa24a327c3649b3ca6148a4b513f338812e583b40d408853dfdb6e2274ab1650c8416535cb90390525ad5d6deab1b79b68bedc6885a6eb52959bf5a
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7ff:RqKvb0CYJ973e+eKZOf7ff

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fr.pak.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe

C:\Users\Admin\AppData\Local\Temp\1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe
"C:\Users\Admin\AppData\Local\Temp\1676093a2107ebbd16b1cd90eb55c56cfa53008b6a5bbb9e1bf495aaa4cf1fe4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
99KB

MD5
9ee32424f1ca64ea420e94d39cccda32

SHA1
4fd0f93ea9cfe209f0371e80b205214ebb4f8afd

SHA256
ea05abb58b032ae87e9ebd23a6b3a6a8f06b4049a2a11371db4904e627920c71

SHA512
786ac9fc9ae655f85323a3840608ceb47a7e5d4d701f9f173c521a511b0fc4e72c2bc220356bfcb9976d98b6528c3f60ce4771ab977483062cfcd5a05c043eeb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
198KB

MD5
037670fc219092a235f1dd7b673e83e7

SHA1
9765dc9a821fb1b1538bfaae3c6824e2ccacd7e3

SHA256
553872c20c6fb79a07eea987d3441f00fff7ae138bec95c285f0c160d53e9856

SHA512
896b0e515ac5274de828449f32d3c2dc2ab0919fd50c73e7f20bdceaa7bddc6be4ee58adc28acd506977e89b88e944f6e42324dc57363e935233546199feabd8

Download Submit