72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
Size

46KB
MD5

c268e88839037c3ea70ac88f88eafba1
SHA1

aaf4a4f4a2838aabe5ca3600358ac25e8f89638d
SHA256

72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb
SHA512

6c1508b340b91b66f16247bfb3d9a74d45bbe429e1c9d2b60651052067f744f5c5e9f70cf12655bc1186e193d618c94e70e672b00719ae0b6d90f66fb787c46f
SSDEEP

768:W7BlpppARFbhbt7Y7wTCg0hcM0hcWqqqn:W7ZppApN0hcM0hcWqqqn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5275) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\msitss55.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe

C:\Users\Admin\AppData\Local\Temp\72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe
"C:\Users\Admin\AppData\Local\Temp\72601aa3270a83f8786fa84ca5ae1d837f18254582993b13e9739eae983f47cb.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
46KB

MD5
a144928186690c61416a58ed233a8a39

SHA1
b2ba277239a4ca3e5f100672a31bba8f8f013734

SHA256
37b7185b6ce704aec9d9ea045d8051ae618ca75920efec603a0d7afc675ede20

SHA512
ca2b85ef37a1b790001719294e8639734fed42e4b0e12ac18f0bdeff2bc425493e4a1e41169c49f5876715ebb1f57459910659db084c8809d13653d234b3ce2e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
6281db78ac40854e5d5c12398309178a

SHA1
a0d2d47bbe05ddc97a8223b08d75f9174d400c95

SHA256
c8de4f5cd10586af09a145a64d81922ecc1ed03bd8e7a10bef0b40fd9f292d51

SHA512
046504c8091af1f09bcaee2204616fb500376e20dd6c1190319364a6a9edb355bbbcd205034fb1d2597120f9d7c0c860a6754eb10d1fa6d002dbb7f66f99f1b4

Download Submit