7f7817116eee66349456128f1aa9322f534ad14033b30af4323b5e864694bcd7

Analysis

max time kernel
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

56da0109b5ef71c1d31124adf57d2ca0N.exe
Size

38KB
MD5

56da0109b5ef71c1d31124adf57d2ca0
SHA1

87f25da3277706aecbadd5d185369c46b3b64438
SHA256

7f7817116eee66349456128f1aa9322f534ad14033b30af4323b5e864694bcd7
SHA512

0b5ba669ec50aae3ec433d8b861baff917a88cc1a41e4e7d5fda581d7fd1c10a1fbb55171f1a94625b111bbff153c97f78b9f22a5567eddd7cf86f197caa4bc9
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLC:W7ZppApBULcfpHLcfpyDl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	56da0109b5ef71c1d31124adf57d2ca0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56da0109b5ef71c1d31124adf57d2ca0N.exe

C:\Users\Admin\AppData\Local\Temp\56da0109b5ef71c1d31124adf57d2ca0N.exe
"C:\Users\Admin\AppData\Local\Temp\56da0109b5ef71c1d31124adf57d2ca0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
39KB

MD5
877b87b0a0889dd372427dfa6ae7e027

SHA1
364c4a8b5c26e9a03fa58d715bb2e4ef61d2dce5

SHA256
eb8480e9d18947488132e0187a1e4a76b01d4c8286775010a58a095e478c9c17

SHA512
d869c000eed2e7ded119dcd2eb41c7b639d6e7752b33ff0330bad8d7a8520d572909d43e3a5a5cd78c6c371a5dda66cca3ace04a23e9ce88bf3d89362b0a51cb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
edb0a9eaf4901e10f4555e797d65e8b1

SHA1
e771cbc55b11a4d60f0a05e6812a942b019ad78f

SHA256
36bcd168ce4f9bcee4378df9729bd72c606f0b629a271517333d0606da46ad0a

SHA512
84a356fe7ed179304d245a65eef163b0cbb31e280853fd5fc08ce5ec65d48350a03fc44bbd2d723bbe79b3d4fa049576f2fd43cba17623042446c988b23df17f

Download Submit