55bf2633d271fbfc9b4334a69dae1ae67935d9d917977873a84d3224749d2054

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aae2353347322981d86937c3a2e18ba0N.exe
Size

68KB
MD5

aae2353347322981d86937c3a2e18ba0
SHA1

7ac0a3e51026858642d66b1b501edb2761338356
SHA256

55bf2633d271fbfc9b4334a69dae1ae67935d9d917977873a84d3224749d2054
SHA512

b891fda2634bc2b609a1842cf175fbd9b17209e88aa83c613e0b03c66ecaa117a8b777e3c72896ed6e2b0200ac1e0566ee3b876dd6e308ea80a1afcfc5f754fd
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvU:6NLWpCZIzjwHwG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	aae2353347322981d86937c3a2e18ba0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aae2353347322981d86937c3a2e18ba0N.exe

C:\Users\Admin\AppData\Local\Temp\aae2353347322981d86937c3a2e18ba0N.exe
"C:\Users\Admin\AppData\Local\Temp\aae2353347322981d86937c3a2e18ba0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
69KB

MD5
0dcab4a8ca0da5bb4142b7bb9c24c61f

SHA1
7bb1e60bc5390a9a27261983409868941cde5202

SHA256
df6c1a736295a024b47c261329e1a54e43a85b4bf83524aefde08ba1899854b3

SHA512
de32918b29a093be95cf8662c4a080ad7adf2d5d9f61657edd11eb8a6fd7a9792558e71b0b76315d430cc8c8f183817e4b01e0f7a0d6654e22f7f998f87523f8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
09a1eff076381b08b07026ab563a0e92

SHA1
b19ee87203254c7e9801a9989aaac0e2a655303c

SHA256
c48a11cad4c60b0e170228c5217d887d2342e1f94be2d2022c1ddd8bb03972ca

SHA512
6888cd002c41808157363f60f8b6723859f301c389da4a5fe729fdbb13769e965b59a959cd04c01722a5c07c0e74835fea6e6c9956dee2c472f061728e58f643

Download Submit