08d01c2b82fa401e0daae76dc6a3188d30e4a4a3df0ef09935d1d9962cb555dc

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88144794e8ff144af8172c6dc702d2d0N.exe
Size

72KB
MD5

88144794e8ff144af8172c6dc702d2d0
SHA1

04b30acdc3b3cad55924f1e28805f0ad14d2ce3f
SHA256

08d01c2b82fa401e0daae76dc6a3188d30e4a4a3df0ef09935d1d9962cb555dc
SHA512

72144e3f0775e951e5984cdb8ce6477f056d841d01eee7516a4fc5c887d6bc153f47230ed08c1088139ab09e50977566c2cf53a250ba24d7a25a2d1d4fa0b3cf
SSDEEP

768:W7BlpDpARFbhYQkQzaxkd+axkdo176/hvYaJadn2vGj3vZd5u5Vcyc+:W7ZDpApYbVK4v4n2vGj3v/sT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3936) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fa.pak.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	88144794e8ff144af8172c6dc702d2d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88144794e8ff144af8172c6dc702d2d0N.exe

C:\Users\Admin\AppData\Local\Temp\88144794e8ff144af8172c6dc702d2d0N.exe
"C:\Users\Admin\AppData\Local\Temp\88144794e8ff144af8172c6dc702d2d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
72KB

MD5
8eaa5771953058cc134b642274f22bfa

SHA1
7d41403931e7926bb7b9eb478e03663902cbdab0

SHA256
18e658f274490adc1bb09603bd1a61fabb3cb8576efcb9f01e23fbc5ea66e6bb

SHA512
259f56c2a0e19032d8b8ca3adfbdf65afd7af3fe686d9b178a0e0c47e7fd3cdfd2aa974d92dd8c61b4ca124183c6840eaa1f607c6ec4cea3eb6cc8b16319786a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
1268c8d78e0d2e9c97e76959f2092d1e

SHA1
993ad023b72143af340716943ce53fffb94d7904

SHA256
99af9d9bbfc0d9ed980d8d755f38bd1bf0518c324b40ee36789327da8b659d80

SHA512
8f670fe1f14d56ab08a6b0f4b479b4794991a5cc23161eaacc9f4fb0582ac75a47f341d7db08f3ac1fbdae46c7768ed6c09e56b7331e2adbd4b8ca98f45dca8d

Download Submit