557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
Size

42KB
MD5

901ba65142de2d317b269c24f483876b
SHA1

6fc83a81df2e074664992f319fe87718e69519c5
SHA256

557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679
SHA512

c8c7adb1711fa769a0d32e97a05ad05459938867d17576496026f55c7f2f7373b48b54d3f6b229fbca2a96d219f2d19447d7231e406f6350a10efe1701a0c358
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbA/:W7ZppApBULcfpHLcfpyDoA/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\FormatWrite.m4a.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe

C:\Users\Admin\AppData\Local\Temp\557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe
"C:\Users\Admin\AppData\Local\Temp\557dba4249940b4fcaa06423bad8c9464c80730d87294af3afcf2c3f2c88b679.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
43KB

MD5
982f1f56e2d18e423caa768db5fa4d5e

SHA1
b5874700cf7ddfc66f5005708194209afacb1093

SHA256
bcf56b12cfa5d616e049aaf93d7ebc563036a8681182a29bd011c875a96b6e72

SHA512
acf9815a974884da707ebec51920ca2d36627877d2095004046a544b2e2ba66d84c81b99bf93de365a6428405c62916b2051b6deea055d3b2e6d899ac166193b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
f289c5fc2ae50bd7f952397cc163134e

SHA1
aab9c7f11b4927fe3bcdcec5d43dea97bf5f7d57

SHA256
fb48ad08e92a8888042d2640c6d070f299668dfbb7f6dc7a4d1d5df24a5688a7

SHA512
c1301da84e7ed18dc5986cd9ab1692b01f75d4e563bea87d41f5a6c6eeb5f196c69e223ffcfab49e37e581d1032d1a26a8b821535866b6ef65e5c76b08ffef70

Download Submit