5d11f38c1f79bec81847f6bf43bddb3ce9b524b3faf5985233d77f50912a753b

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f792b5c75995cf7171f735aaf31660N.exe
Size

37KB
MD5

27f792b5c75995cf7171f735aaf31660
SHA1

ebdb1dfed136902710fd0e207c8f54e4e1e17599
SHA256

5d11f38c1f79bec81847f6bf43bddb3ce9b524b3faf5985233d77f50912a753b
SHA512

1fddc31968dc07d33d88490b1936c89e31a6695f1d925fc656ed139071485f7d477c05e1a514b3d796bd9e8a7bc5873159aa40d14f9201d3f08e25aaff5b88e9
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1h:W7ZppApBULcfpHLcfpSo3fP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4696) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	27f792b5c75995cf7171f735aaf31660N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	27f792b5c75995cf7171f735aaf31660N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27f792b5c75995cf7171f735aaf31660N.exe

C:\Users\Admin\AppData\Local\Temp\27f792b5c75995cf7171f735aaf31660N.exe
"C:\Users\Admin\AppData\Local\Temp\27f792b5c75995cf7171f735aaf31660N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
37KB

MD5
de002c59a67b23ed42a37a6f63a184fc

SHA1
1be1e8805c010b4c104daa724315b4570cff5b81

SHA256
eef371dca71a5d44d6caa5ae6784154f0b0d50b457efc6f43edd7b601ee52e2a

SHA512
675512c897c4b61920514ec3c6e770d0629e70826e7c14b39f28db77941f5202410ff8247106fb0919a678a026d3ad333d091f5e99bf3d7b4ec3a790fe2c3ae6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
7cf8d13d2b58046ac5f481e631dbffd9

SHA1
845747b6f3271add4fb495ee201323621bda5a7a

SHA256
ffc55d535cceeda43debaf8867399c6e613522817b57cf8bb42c4a8714cbc836

SHA512
9d1080f57d50690290a17fe2ea1ab551a70e4ea2413fb1e2d74557db333af5d49e44485a9811165c133564b500d2477e3b95e0d2e21615f35a09ce2245131b19

Download Submit