85a9ac4b8e6d74283f95f2b0bd2d775369e5e2dafe4c7136a201f6445f481df4

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5574f6929ffb6a525059837d1625c350N.exe
Size

43KB
MD5

5574f6929ffb6a525059837d1625c350
SHA1

d99579728736612cf2da15b5172410ce376bc4f5
SHA256

85a9ac4b8e6d74283f95f2b0bd2d775369e5e2dafe4c7136a201f6445f481df4
SHA512

f2d9827017ea2c537a821c8945e5e8c5a63eeb3829ffd6188caddbbe1ce5be684273b3fb6322e346e653b23c13864684d6d09688f44952afdf9c98457a9d34ba
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNQFrs0AqAJwO1AqAJwOfF2JouP2JouQw5A5D:W7BlpppARFbhHFoqAJwBqAJwRJofJoTT

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	5574f6929ffb6a525059837d1625c350N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	5574f6929ffb6a525059837d1625c350N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5574f6929ffb6a525059837d1625c350N.exe

C:\Users\Admin\AppData\Local\Temp\5574f6929ffb6a525059837d1625c350N.exe
"C:\Users\Admin\AppData\Local\Temp\5574f6929ffb6a525059837d1625c350N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1296,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
43KB

MD5
d9ec82e244d64065e06a672b608497d8

SHA1
02ce70b5f79b9f44b3c91c68d7ee41d23a563a26

SHA256
2870ff51c40701fbe42ff3566c720625ee0805eb67fa2a575a118b0706e025db

SHA512
c44207ceb22b4d9e03fea63744ccb12fb90deef8ce0b6afb8ccd370922435e0c9878fa6b523a7ce4708fe3624924141f2bcb630d11fc4becae5a78b6bbb738a0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
155KB

MD5
973d86736ae8e87c3d1e11c6078752d5

SHA1
a998be6310fa60f759cab02aadbc03b37a385bd0

SHA256
d156c3d441e360bcf670f45932fa4cd454c826ac3c3f42d679a22ddc76767205

SHA512
c31cfb3dd1e9631dde20631787951611f84cbb917af109f0064a406f9076d23aa707c876fde602a009256019219c04e300cfc3e91e62723c09500d5e4a276644

Download Submit