7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
Size

57KB
MD5

6ff43b1450df9227e1bd3469b9430312
SHA1

024a4ce1b35cecd81eddf57a22db084a2d6d2b54
SHA256

7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc
SHA512

f4a196cc6d87301c911d2c9ebddbee7560d7f57778d3f607e6bae4fcfcdac783d3ceb8eb3f9b74649e86d110e9f1ae02b53a497891d7aae3fd2175909c3b491a
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7lSKSW7afHFCSW7afHFIkm:W7ZhA7pApw03vR03vxSKSWu0SWu2km

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5272) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.WPG.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe

C:\Users\Admin\AppData\Local\Temp\7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe
"C:\Users\Admin\AppData\Local\Temp\7adc344942d7215b5a417b4a9e881d474cf7eacdf8690fa4df38234259dca0bc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
57KB

MD5
898e23890aa37765aba26d9796f06589

SHA1
556efd7aae972bae3a912b69cc7edb2255a85527

SHA256
5ffc066dd3210b3f5dfde9f599d3871b5547df2af3b23c5e03e9e33bde669c24

SHA512
acf4766dc0e784b28252db6e348217c8fbd21a0f69669f45345360f4e7f86e8fe3e8ddbac7c38e62298526133e86762a8431cf673482e7d284fe1c9e8e4b4ff2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
b8c9b43980cddc7fab9bf2cf61b5d627

SHA1
1e3df1d858471f907c3775fd596490b5fa47ea46

SHA256
21c104568ee25fcfac60e6ad4229eebf72643fb356cc80dc7fe3d8cb8a6651cc

SHA512
b4092130c0893ebdebe255086765133d6fd9a10b0797ee3ccb3bfb175f691d99d8774adb684f06bd89cb1eca4c71c51d508ec8d8095ebe0c02a6bdede44647d2

Download Submit