14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
Size

88KB
MD5

fbf0411b9eb5860998a9708e26e6d566
SHA1

84c54120c4811a5f5200f7a1517d94378000778a
SHA256

14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00
SHA512

ea5981438c19aeaa4c0e8e3d2a331fd39bb4332812fdfc3f9078a7fb194ceb71c2aa031fcab6abc29c3c40e390d3ca0c5e8fd0a7ae570a2a36841011fdd86fd2
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWYkjk1:6e7WpMaxeb0CYJ97lEYNR73e+eBSW3A1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4863) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe

C:\Users\Admin\AppData\Local\Temp\14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe
"C:\Users\Admin\AppData\Local\Temp\14601e21d2307e0b2486f99fbb9bda26dd0fc582f63481dbaad54563abaa2f00.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
88KB

MD5
e32b7f09b1b21401da955cb60a1e776d

SHA1
11d158650904faa828e36bec6750cd37c2924f98

SHA256
ed7f8af0e07c9f634f9838e9e13c22d6ceee7b336bbe7d40f4e997433c78a4cd

SHA512
b0fd01376a7c007ca5fc594270160dbc88f7b3bcb9d8577bbc09b6100ca42463a8eb1c832635aa7f01e37431538e14fa9c88228096b86c70445749ed9bb51e08

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
200KB

MD5
634a0dbefce84950353c12a085f270fe

SHA1
5db556dad44dc0d3dde7eb73bb00b2a6a2ff5948

SHA256
3e48e328093ee091de4068c9f8d6b1a3148e97279c47b6a61b6d6f1cd246a5ad

SHA512
9d436b76311037e0ce3e87dfde87b9382892a9a272240c75e52ac6bc4d23368e79441d1f0c99b12bffa4747b2673addd348720f2b2ba8db500f0a862cbcef2a5

Download Submit