a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
Size

61KB
MD5

561fab5ac48a8b04c11a34eeb90cc744
SHA1

05346da6d3e6738f4991048a1bab3eb17dddea8f
SHA256

a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef
SHA512

da46f4a50686734c2e472768096e2d83cb1515bf4f33a8b565d707d440e61a50c2670763efe6121d7b6396afe19050b10f9c1ed884240fbf03f067e3b0f4f07f
SSDEEP

768:W7BlpppARFbhWJq5nosMosToFwA9J/iA9JDwA9J/iA9JmGAxBxV:W7ZppApF5noZo4oUGAzv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2122) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoBeta.png.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\he.pak.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe

C:\Users\Admin\AppData\Local\Temp\a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe
"C:\Users\Admin\AppData\Local\Temp\a0782e9a2afa0d693e4a252a33a5c922f92982b1b80bef046977d62d4d2bbcef.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
62KB

MD5
2c22ea1b4f801b01abeabe8cf01b7174

SHA1
727f567e141c161c433942c7447863213029a7ac

SHA256
0fecea9a028d2132ee913004026305c584db39b355b0723cd82c10647baf0998

SHA512
7f521c6819f6fbb4e4002844db6d5a8c895f4ac2ad952ed29c64943fd5a365347e84c462974f612db10727cbd8f08002c940296496f74ad61ee1e73bd2854ffc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
9458d9db704be00ab430c1c5e0fb3cd8

SHA1
7fcfb70a026b008d6636b2d9bbfb5721bf532907

SHA256
90747521d3879c4bd7af1c595f05e919b7f7ed14e5cbd3d43a90b654e3b28ff9

SHA512
0ca4bf732a1750dcb2d5a8c1f489884da1f523a2728321a42a2d499b8ff355c7eb1acb66a261ec8b9a3cccd4178a63fa5b689b54a029fc8de97a8ce493f2fa42

Download Submit