a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
Size

89KB
MD5

63a87a9ca3bc0369a76d7fa65b838450
SHA1

583fbf679757c65fe02c719bfef3c64f5c3d8845
SHA256

a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27
SHA512

a569bf9cedc120c54ca2d86dc871b077c574905e7c3ba51ad7e54b7b95e35a08f168883d211362568e7fd5985d19042d1c44b449f9c0eaae1a05b37a2e25ad2d
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSo5h:6e7WpMaxeb0CYJ97lEYNR73e+eBSo5h

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4842) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe

C:\Users\Admin\AppData\Local\Temp\a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe
"C:\Users\Admin\AppData\Local\Temp\a9f062071c536bd9e65544fa1e837e5b927bda750ee566457179da8ed344cd27.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
90KB

MD5
5ced653f3d483410f3dc5951a3b6e7bb

SHA1
0a704943f5a7397dfabf434665a6e3ea70ce3109

SHA256
7069ba87f7402d7adcd8ca6d076bf846c61bf611278df93d5f8a9dc2d7ed493a

SHA512
1a18c0b7c1f4ada0d3089178b6e2c243b8c80f13e50bbf08f8771f52f3be7f20cca763756e04f10920de0ffe5530ba0c193f8fbe7a82b722016c01f9a89fd798

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
202KB

MD5
48725907687bc2dc8c963f0ad52ac762

SHA1
bef8445c57938c7ededf9d01d7427e29103424ae

SHA256
8f3b8b34c4cb8833c1ccc494e9ee301410a6992a8b6f58ff95599d18e920b70f

SHA512
0f83a60d7e786e8ba680307aa416d47aa8131ced5383719ed088d29d0f6499fdbf309a804354e355a925811e530c2ca79dc1501f6f34d2ac550baebc93fc380c

Download Submit