5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
Size

39KB
MD5

6d451bbcb45382b7ab7a140de0341e08
SHA1

14f23696df1f9843790f45279ee14eeaa57634df
SHA256

5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079
SHA512

b9c0073e10531a23bcb06d6646c7821b92b698e54b09cf23bda19f4fba3a64511cb519487d00eebde70041009c6e93ac04f976db7a4cedd610e5f2a46cf4ee46
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpdjS101d:W7ZppApBULcfpHLcfpL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-BOLD.TTF.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSBI.TTF.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\FormatSend.lock.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe

C:\Users\Admin\AppData\Local\Temp\5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe
"C:\Users\Admin\AppData\Local\Temp\5365bbfaccabb8cbd8af6aff98b6c7e65c6a2a559671849434111b17e3392079.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
40KB

MD5
54e2e51d9e76894cdbc0ee7f35679776

SHA1
a419f1416c842738f460cde9d308faf72f58938a

SHA256
ad11b23444ef093da27c2ff40daba7812380227f5923d695ca7bc36160fcc213

SHA512
0edd9c9d174a0e9c8aa154846da441d3d97ad6039a8ab99dccca28c57428fab89185d6e4f84db575d5085e67e58e69fc0f5d7861966bbdc1d9eb22ae0d8e2ebc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
579a0e7b5fba77ade3a67fa6004fd3c0

SHA1
dd09750e5a8c96e26a41e5e86ca77f4914123d7f

SHA256
00b0fb6e4b2eb2779390f38d33cbf4f88f911afd2f3f65bd186a7c93e924a814

SHA512
49c91ac5ffc880dc33516c5dd36ae8a555bed806d8510095cbc297d307a5f659103c468acbebc6296191fc632b36ee41b1aa762d86a6ba011a8fcaba3cce1be4

Download Submit