74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
Size

109KB
MD5

48896acbc45b8d84d561e5f389f96ab5
SHA1

50bfd94da51fc79e54b104d78d2ae6fa44a4ad7a
SHA256

74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547
SHA512

42afc4574cbe2812e477110e7a23c89b588a93e1486da3cc80d67e0e8ff10c969d8acf70902520f41a88c080b0bfdf04147b22132fdd89ce265b93505b1ed6c9
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXaSDxls:RqKvb0CYJ973e+eKZ0VI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5013) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\ClearPop.wmf.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe

C:\Users\Admin\AppData\Local\Temp\74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe
"C:\Users\Admin\AppData\Local\Temp\74bc38e5698fb2b6b4d42ec57559779d6cb99b4f7fc10261fb68b759b7ab8547.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
109KB

MD5
ce653418f677fe61d8a0ac118bfa3d45

SHA1
314bf1d581666c15025f4d9cd4bc608ef77c8256

SHA256
96d877b5286062b23ae87b1636301c456fb08a2b1170e00ab4243a7a269b291f

SHA512
4ac71841f40fb9df2694021d88dd5017fd96d3e3bca3dba7a72cac439aafe291905532c71c46d4401b711ccdebf61abf71916ca9cf1548b8f3de1a8d48282503

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
208KB

MD5
74ea88936496d2a05d2c4a799b5be93e

SHA1
23c7757c42413901bcdb1037f0c30f82b93ee074

SHA256
ada909597921865f7ed77c01ecfd7e513bdd7dd7410edee33162c83f62d9bd16

SHA512
5bcb1f8d9c1fb6aac78ff374ce7c043205dd0a889066cdd689747f652fb8dc9d331acb73e741a8db754289a1d9cefd4d2b788d99fd93d80fcdcbf1ea54f3a27c

Download Submit