ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
Size

78KB
MD5

ec3e1ed1a6fc586778f639566bb87c60
SHA1

50b3939bfad370ad64b7346546b3cf27a68fada3
SHA256

ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323
SHA512

f0bd1226e64dfc31fedd2680da1eeb445211a35d1d5a9822357f6f611962a707c055987a7d363f1dbb2f5db2cdd4bd2be9b375acce9ce2daf32571120c804aa6
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSv6H:6e7WpMaxeb0CYJ97lEYNR73e+eBSq

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe

C:\Users\Admin\AppData\Local\Temp\ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe
"C:\Users\Admin\AppData\Local\Temp\ba5764696390b291227a546936025d68f9ec55a54c578c162363c38c4414f323.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
79KB

MD5
80b9856437b97482d85cd71e8f63b451

SHA1
d96fe8115423c80c93536dceb5e394bf47196443

SHA256
b3e5f4381d7c859955f5b583ab11e1efb1370afa4f8c95a87155df9cae643a45

SHA512
10779692a41c418e36c021e63c5f548e0d33b3143cbd81b38ffcc1950d3f50bff2e253c017a5e09af6dd740d0fe277019b26df40836148b70d0622b292e1e0dd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
177KB

MD5
a47bb1ca8a52f3c63e3996cd51651927

SHA1
57e0b9a2ec521c36c5a7f2da5ec28867caa4f806

SHA256
8bad6120bd419e79451a2762f430bea1aa403490ef6fa241792484e9f3a55260

SHA512
93601b18bff477fcb68e0e69129d82b22905c4e747d57ed97581ce69e803316c2b76d5947485b78cd091adcce02f6183a6b0f9c40a950192062466bf0a269c5a

Download Submit