26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
Size

33KB
MD5

ff9ecbec0ceaedba8084ea41223505e6
SHA1

813f4e050811f54eb8e04f0592a73bc65075c444
SHA256

26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c
SHA512

255136888576292f6008ff37f64c5392e9bd5360d4dce639387428603de80f67f031e2fff7bd7f8997e35095af4929ac2264d8e42ccd823e7d529f367b37cd7f
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpqSwnwp:yBs7Br5xjL8AgA71Fbhvsdwnwp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\Word 2010 look.dotx.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_wer.dll.tmp	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe

C:\Users\Admin\AppData\Local\Temp\26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe
"C:\Users\Admin\AppData\Local\Temp\26a90f36b8c8521260b85814fa6f84b227ae268b2e21f1914ee752669131580c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1266786182-1874524688-71015548-1000\desktop.ini.tmp

Filesize
33KB

MD5
fd0ecb6e00e2df5ec19d6ed7e80e644d

SHA1
8619f26a64391d05c43446afa2521e8bd5d29efd

SHA256
bd23f6394d5445852e73679a31b1cca3fb634525bf56c50b1a97c65c2b25642f

SHA512
70524858b26e9450232902196f5e3165cf654cc6c800a12a0d46953dd047aca27b7ef29df9237bbf70a1d78d17f204ded7fdae5ac4547376d92fa321dd52093a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
132KB

MD5
e0a4098aaf57572045a03213c517259c

SHA1
6b93f49619ca3713b3468e806f91c9dda646114c

SHA256
6c70e42781c10afabbce717b10575450180d01acba9e88f81131406cc2b4c387

SHA512
bfbe63e777e31ee35de71bc931c3904aa22eab174ec00edbbd910197165a7cae40163d5b8b7ef2f4723b50cb0f07d031b1ead47aa22a64de6d54523c979aff5b

Download Submit
memory/2860-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-1968-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download