6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
Size

38KB
MD5

4147270974e96a0399b4f21964be7540
SHA1

5e59a40b88b3b777c5705c73f0509994fa431e7a
SHA256

6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242
SHA512

6551e34bcde2cea22e433e12e51669bf7f7eab2c7224f0637f7a9699b9df8887130fdc4c36b57d10b23a9204c50941ced5489f10c372087dede2b9bb017cfe9f
SSDEEP

384:GBt7Br5xjLvassAgA71FbhvYD/DggNNHpQKMNHpQKMM:W7Blp2sspARFbhVgNNHpQRNHpQRM

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe

C:\Users\Admin\AppData\Local\Temp\6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe
"C:\Users\Admin\AppData\Local\Temp\6f0eb3e12b300da0a5768890f5da9cca858fa952b790576ab4a1fa52e5f74242.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
39KB

MD5
355947854da7761cd65ec5399f309f5a

SHA1
3860c72bc80a171c66cc424cc0cd7f9848bf179b

SHA256
ff1eeca032c2165c5a3c717186513bb800199652f00c1f97e71078ae06137ea4

SHA512
9806b2274b786b2a4b1c8058a6e967f0c519d47b490b98e20b89ce521a9b8858d061b0c0a544541b6b440daaa41c7562a05a508f54a1e4da565ade7c7dfe7ba2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
1b732d99ce66cbfcb93cac669de278d9

SHA1
dd761441f00581a5d7c2a9f083f7d08af3a0e47c

SHA256
df166a04e304e0a6d868d545db9af35cc86fac1e14e1e600a6e3b9b1379df7b0

SHA512
5789a43f495b29ce811a75febba0179f485d21752a4c3dfc4c077c032be1169740b554d30208cbdbe4afb9e94770ab410968e4238dfcf1cdea10b0dcf29908df

Download Submit