69e8a6386eb3c1403bbefb14683935309026b0d48e1f8b92a9cb7870ab99fda7

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17c33a5abf675f123aecd9eb0685d2e0N.exe
Size

85KB
MD5

17c33a5abf675f123aecd9eb0685d2e0
SHA1

8a0f827743ff22d631fa51054528ec734234dc46
SHA256

69e8a6386eb3c1403bbefb14683935309026b0d48e1f8b92a9cb7870ab99fda7
SHA512

2b90c7729878e9edd8780341929d616f669df4694893ae9b34124bca6084a73df8d5f5edadd963b068b1094bc21dc59370072f018359d17402e2311f146ed42a
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhS:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4558) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\default_apps\external_extensions.json.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Crashpad\settings.dat.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxil.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	17c33a5abf675f123aecd9eb0685d2e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17c33a5abf675f123aecd9eb0685d2e0N.exe

C:\Users\Admin\AppData\Local\Temp\17c33a5abf675f123aecd9eb0685d2e0N.exe
"C:\Users\Admin\AppData\Local\Temp\17c33a5abf675f123aecd9eb0685d2e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3774859476-2260090144-3466365324-1000\desktop.ini.tmp

Filesize
85KB

MD5
8abbe4524e23f1dc7396a1a7faea96c1

SHA1
2e1f298f6a36f3050a5cf65b1f8ef3219b0654f7

SHA256
e581aa3b2ae2d48a2254090c3aec66182e3b8a9c5bc77c34c7cd608426d50ab1

SHA512
50257d2a7622dc53e5573ef8970d45cad7560c5c6d7fdce70372f770607d1203b7e91b415d21e80b7e05ad400cc61624be71279d3d9f0e73b39a1776245153a1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
ce1e7529e3675d118bec21edd71855a9

SHA1
cde091e83b2bed963a435cc8cf0887ac3ce24409

SHA256
6f0a95f46307a8a489694765d6a8934876edf21b42fcb24ce001c87b483e2ae9

SHA512
bf243a1b35fcc52b6548bb8e8e3392fa09168508e2c9595513ce4ef7d65862bd82939c0e48577793138283e62141c8c92f61f881ca4be2dcff2c312dddc1343d

Download Submit