364a2187da7dcb3c8093dd1f54ab6137391a1248b39b95b949a917e35ca90f13

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
Size

44KB
MD5

691eeaf8a16cffe9511e7fc3b2ae2b30
SHA1

215a2eef0157c93f2cd84cc43d6daba22af0fdbb
SHA256

364a2187da7dcb3c8093dd1f54ab6137391a1248b39b95b949a917e35ca90f13
SHA512

bd4d682ae217a6eefd9eb8260104fcc9855a6e42ea6b031102cec7246b1d9d0bba672fddefcae638f998858f1fa73facda9485339703f1ac9d3b8ca4f650438f
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVy1CQCm:W7ZppApyVyjVy1CQCm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4661) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\CopyWatch.xlsx.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	691eeaf8a16cffe9511e7fc3b2ae2b30N.exe

C:\Users\Admin\AppData\Local\Temp\691eeaf8a16cffe9511e7fc3b2ae2b30N.exe
"C:\Users\Admin\AppData\Local\Temp\691eeaf8a16cffe9511e7fc3b2ae2b30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
44KB

MD5
cf97404914dabfe85820d84a39f530a9

SHA1
1cb672379cc3a44350da258bcda2ef9127b22cfb

SHA256
e54be99ebab871f00cd6cf3c6d3dcb84e4bde4da8fb451b97f14a575ee69cb7d

SHA512
3d97c5fdd058f4f24d0259f6f27736f1d6347bc3c480afda94577082bd90d370ec3859c361e6f555e359fb8ed899367a2cf8c4444d7ee435c2b2c60a3e635123

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
e184272db450bd790242c28d40f6d01d

SHA1
1d9b9628db42e77453917da0f1b4b937985f2c77

SHA256
fa39e4dd54974d36c48b8b3bf789e453a623889c292d86ff3c855597a1974163

SHA512
93a3992fc2305f8e8404d83f5fb16c7efb353aea2e9d09a4f2c92e4bdff5e27e79711b5f4ff29c9eedccf561ea8f2065c02247a707166c88639d5f16eaa016db

Download Submit