da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355

Analysis

max time kernel
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
Size

56KB
MD5

3a211e07e8fd6856951070bf7136061a
SHA1

dc9d92f6b214869aec2f4f337f91d35c8b2b319b
SHA256

da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355
SHA512

4792a564532569b176551959294860a6a58c5ff799be14ba2d32edce06fafe2385fee92d27e8f3f00f6c0a08d71b34179002f1ca004a2bfbdb32199fd3d993f5
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0aEMdV8IEMdV85/5:W7ZppApBULcfpHLcfpX2/Nw/Nw4xa

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5016) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe

C:\Users\Admin\AppData\Local\Temp\da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe
"C:\Users\Admin\AppData\Local\Temp\da306b1ee2eaee90022abb6a664dd2061c725920eb291878217bb99b52261355.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
56KB

MD5
0a08cad7d11af987d8a12469d4c23211

SHA1
51b0fde0c0e9eebf111b8b4f529c8c96f4a2ada7

SHA256
b29311c459c8fc7b80288b4a77a962d4afa8cf6d443ac944bc776a7fed0109bc

SHA512
a57bbf3074907d49164f64ee3f9c70dca9360b5df565627815a555e77002257d300801963c94f5d59201163f912993e9b8b12daf28bb482d2ba023ec00a919ab

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
83e54c1976357d0929e1cff51f4d15ba

SHA1
2b2da83ebf12afb8cf37743380aa5d3cfcc99e59

SHA256
39d282b6009d69214cb50f76380770d97b56d4f8e99e150b95ec0fb2334dd830

SHA512
970a10d78beace72517ed6db73ae3aaecc4c19588b2c8e85832fe0d9ad49ab071a0f3d1a74fa5b16f4c4bbe5184ad047b4ed44b37797c43e740c1f06baa14728

Download Submit