a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97

Analysis

max time kernel
150s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
Size

44KB
MD5

49678193844d0071f25fa5b3346993d8
SHA1

98de30b2a354ec0b99d02896131deedc69ae11ae
SHA256

a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97
SHA512

56763afff9d91cd077193804cde0965bc2535b83897fefa27341b8997955b79cfc3ddb3abefce41c2f596e6e01293c325c3fb091bb0facff0e3e8ed8f2c01f59
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0k675:W7ZppApkGpT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5022) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe

C:\Users\Admin\AppData\Local\Temp\a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe
"C:\Users\Admin\AppData\Local\Temp\a364229816e4688f6146e9d9dd897f8a7060b192de01d4548de584f5cf484c97.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2077438316-259605770-1264560426-1000\desktop.ini.tmp

Filesize
45KB

MD5
aae7424e4a0d26e5359491708c8b118a

SHA1
782bfbc81f3c5ba4c511347fc6e5bd61fe18e13c

SHA256
e0d5f2d0563c2559290ec94f6998d1f3491b12abe8afadd20626a2b32f72faed

SHA512
4a0028a97f057e373a5a6a909b30b497d13de3649eba90aff0e63724caf1229c738bea1498f3839af2de3ba127a0256827c7208d2c728b740a885f430f64026a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
44df5375353af8f28b71f8ecfd75b4fb

SHA1
68f020b668976cda47bb1ca60f51ed88a947e420

SHA256
0faf5c53a2c32357d1c3f31842c270068d0785aeb612444af5aaceecdf2aad18

SHA512
c36132fe87ee523545e269bb14ccea6cd246ed7b8bc80f318312418c4aff3d6416155d4cedfdd61bb22cd1389cf35ab771a2043f69a0080e7d4f5b0078bdcd32

Download Submit