7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767

Analysis

max time kernel
150s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
Size

54KB
MD5

a977aa35317bd7c69b1962471beaaee9
SHA1

a1b44a0e1bf95f5dfa51ad30a250d67f2db27b55
SHA256

7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767
SHA512

13e5ca0dae5d72e3018e6a061b179d84b67e537ea430263e97b43396df9654b0f12b222a0e0c0a8bddb918150e44fd3c3a321da70278be0d0e251bb793b8a204
SSDEEP

768:/7BlpQpARFbhdS5c5mRawAlW1VkRawAlW1VCkOROM:/7ZQpAp86MLkLTAp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\SEGOEUISL.TTF.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\MSADDNDR.OLB.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe

C:\Users\Admin\AppData\Local\Temp\7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe
"C:\Users\Admin\AppData\Local\Temp\7d3225f5c709e930ea3a055f4ad999e3c112c427cc492ebeede52a8fd29e8767.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
54KB

MD5
dbd6db298ebb7067dbbf5c56630715af

SHA1
f59c7631ddec83294af9c6e883c1f7dd36805a20

SHA256
914a2ff01c889e964b158fcfd2826f35371391c38a5d4ee4e8df1cf6d2e563ed

SHA512
1d36f38f9c9f666a07cb2cad451a71e55f2c4073ee701e598d7e70e2096db9cebabaebeaf9a0adfc5737da9755e1e4285c322c0afe115199a301037d69920bd7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
1bebd2cd4d24d8e1fed5ecf1e87ad408

SHA1
6e6626f5036b02c2e2a9aafa789c3b1a0ce8146d

SHA256
04552364ab99924a17d55c41947b468a6b1cd3ef772240a5c76c25f145e630c9

SHA512
18063bad5f1744acbed5598961d44f403620e42cc869bba50684f08e49bc5a3b46d0bb17b7dc04a361c84b3d70d1a4cf846facd1873817400b434c72f038ed0b

Download Submit
memory/3208-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3208-1990-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download