d1a081972f62549a2bcc0fd80e57120e2655337b941d6110403304c345c01e51

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5191a62716cf874632344e22ad08fd50N.exe
Size

37KB
MD5

5191a62716cf874632344e22ad08fd50
SHA1

32157b426e9500c0991557739670615d107fb5cc
SHA256

d1a081972f62549a2bcc0fd80e57120e2655337b941d6110403304c345c01e51
SHA512

2c969b37e117b3428fde73206da7b3af215ee44a7b95e9d68b7b9d61e3bbc4bf50e354e52021673950c14f8c72ceee9975934613d5a4e7440380ebc4d47bacb2
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFP:W7ZppApBULcfpHLcfpyDP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4688) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	5191a62716cf874632344e22ad08fd50N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	5191a62716cf874632344e22ad08fd50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5191a62716cf874632344e22ad08fd50N.exe

C:\Users\Admin\AppData\Local\Temp\5191a62716cf874632344e22ad08fd50N.exe
"C:\Users\Admin\AppData\Local\Temp\5191a62716cf874632344e22ad08fd50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
37KB

MD5
395dfa1c66bf695bbd88bc01fe221a60

SHA1
ead8c9f2459a8a4eff57d75ab00b1b377c90350b

SHA256
0be8f091224b26d81843563fb9e0619a4613dc568cae0d4cf0acd28cc289fe00

SHA512
b4263ba737155f0ce75b41ca6e7f8544b1c3dc847c93bce16ead141dc0c06eabd9ad04db1fc3c57dfaf912c138727a83870506d9c22d2fbc2696b198bb55d17a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
d4eab670d4f3709e530b2de366c5fbf4

SHA1
0b2f10b1f7a3205122545d8c985b121b0dd3741e

SHA256
95c9a17d9b584cdb9df5c46da05f69b4272a1e4f2e01cbcbe99fb9a0d20c5fdc

SHA512
6050d57d8f3f71005c27dba39ee60f1e9071305b3eb098d0e6c0488ea4c6967202cb541f7185bc6240783745dbdbc7bcea9b383d2acd6e2e0a855597e691bb20

Download Submit