7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
Size

192KB
MD5

da7e9385251d0ca4e2d2ffd07c6263a4
SHA1

4b7e958756b16d353063af6eab3f130747a46313
SHA256

7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd
SHA512

e8750fd88263e7b3457b76e59474f5f61575324d9ce3b5488e8d6fe556d4ad30d152cf18713ded753cb44093bfb92de450409d5034e095f3cc301c0ef71948ef
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkX:RqKB+tOkWKR0iJ0lTzkX

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe

C:\Users\Admin\AppData\Local\Temp\7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe
"C:\Users\Admin\AppData\Local\Temp\7c52006b2be624d003f35f9a65bba81f20ba915dac1bc47653f8e370eb152cfd.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
192KB

MD5
8cfeb09eac69bd6bdd1e17dd2dbc97d1

SHA1
bb98cfbeb2887202b105c8529787fbfdfec8c9f2

SHA256
320c59355578779affc2f34bd956c76585e641d7a40ab071cd306d7e0b4364ed

SHA512
7a999a9ab5289430c06b801f227d729537a71b55def8b8a9b27240a1a09eeb3e0f721f69beacd44de1636444e621c1f0c05d6571aaf5096a807502b1744906d0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
291KB

MD5
f5ce443f4e298cc8b77666faf190f03e

SHA1
df4496da57ced1d9e616c911c0ae3d89fe8789e8

SHA256
c2235a3926f44d4320260d8ac6a11a8f93ebbe0a6405c1b3d151c9ca7611978b

SHA512
12037f2136ae16094a47598964d82dc2ca42402296481d8f3320c2ebb297929cb070cbd1934be55faee0124c13886e42f06e0a6ae443f417993a1dda2821e6ed

Download Submit