5b81cec65b0df1a692daa7bf6cc1ded2ca9f4e0ea30c52da07df5252976ff183

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a699fbf2acd1776a97bc058355c4d650N.exe
Size

57KB
MD5

a699fbf2acd1776a97bc058355c4d650
SHA1

df0b58c9a4d991b726b6b806110a1db2c521de57
SHA256

5b81cec65b0df1a692daa7bf6cc1ded2ca9f4e0ea30c52da07df5252976ff183
SHA512

0c1ad9f0ceed69f314fd969aa1bdf65f0656129e5a4b6547054b2641384127dbdc34bc9d5f9a1768e7b0d5eb39c0ed2f437d0400a6a94af6d2e7e67a1e2b32df
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJxfFpsJcEKLF/MF/28HaT9j:/7ZQpApze+ejfFpsJPKZ2e8HaT9j

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4107) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\nb.pak.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	a699fbf2acd1776a97bc058355c4d650N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a699fbf2acd1776a97bc058355c4d650N.exe

C:\Users\Admin\AppData\Local\Temp\a699fbf2acd1776a97bc058355c4d650N.exe
"C:\Users\Admin\AppData\Local\Temp\a699fbf2acd1776a97bc058355c4d650N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
57KB

MD5
5633df83ed8459592390d48c627d72e5

SHA1
a79aa06380ce2b369ea021122ac52d920c0bf96a

SHA256
57a91243c64466e7fc50466775cd229cf61d79f922fa0a842bd7751baef39a3b

SHA512
463d02cce68298d1896c56cbdbc7ff4666d4894760607268f051ebf54dceb8ddeb118ddae99e3e5b0e564b994de4366f4d16129998172f5e83e5c80a7632362b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
775d6a9007ee3ade287dc26c91326fb5

SHA1
82d29d7e32841aff2d335e0a5e7a3d5cc7149b5d

SHA256
65d86f48d6b50af74b624778395120c7067c5199eb0e7e46d433f853a7ec24be

SHA512
31cc0b3edf2ff8107b01c23b1fbcb351553427975289f62509c7da400cbd7aa34d511f5a966db66af26d5f811882583c805ce11312f7f91f6d47fbc0b6137c5a

Download Submit
memory/2428-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2428-1734-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download