7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c

Analysis

max time kernel
150s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
Size

101KB
MD5

29003c0576955c0fe320d4334302b01a
SHA1

30c2064056c33b21431307120d0d82bde3ebbc1d
SHA256

7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c
SHA512

9489603a760c2686a272c8a8e38feaa4a5dde2950e57a99d2f23dd1b24ac44a5bc228e6ca65e6cbcbe698de752a98c68cd67373fe3dac2af9866ac733f1bd27e
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXaSDc:RqKvb0CYJ973e+eKZ0Vo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3706) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ms.pak.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sl.pak.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lt.pak.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe

C:\Users\Admin\AppData\Local\Temp\7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe
"C:\Users\Admin\AppData\Local\Temp\7171646f8abc4aa3afbee1895e8006b956c4e738c5d2c6c91ae676d653eb0a4c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-47134698-4092160662-1261813102-1000\desktop.ini.tmp

Filesize
102KB

MD5
32e55ec2202906869ec629eb96dfb0d3

SHA1
c459923305856371b0226f8c6278c605431f60f4

SHA256
257e1cad2c1f530fd1a2cca5827127de5247403bfe1ac5029245b7006f87ff60

SHA512
b504c117290f7ba1552cafd9dca5e7d3a0ce75477eb047018e89b4456d91d83744240e83f20a6c982c961b75806811c5558686c10c4ffea3787c4ee27646ece1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
393d21abf9dce47d26a21d147abb52d0

SHA1
c71f1ada68335cf3f8376324244e596ee54b9e2f

SHA256
c0d8ebbff50b856e7ef6b27a0b3c00a56aa2433df8cf1ffd3cb253a5ff2104bf

SHA512
9637a21f7a4fcfbe69bf057ed1047b1eef12b90f6a3d11554082b04de08f74fc3d00ccd2c67f8ae6d150e4d783477517b2791300f5c1b566dbe4551e9e209a6b

Download Submit