413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
Size

63KB
MD5

c6826d4aaaadec7aae20adeeecec342a
SHA1

91b038dae428e115aeb7222306d185857af485f0
SHA256

413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30
SHA512

1a12fc29695d1f0f14160ab63c81d1d68ec472f0ecfc068c1ae027c3776b269ebca35358f00235c813b23753fba133fac60acdf3a65d21b2241298313a090e78
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwOvEJcvEJdzbHVcoN5i1xBzbHVcoNx:W7ZppApqvZvabmRbmw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5098) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PEOPLEDATAHANDLER.DLL.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLCALL32.DLL.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe

C:\Users\Admin\AppData\Local\Temp\413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe
"C:\Users\Admin\AppData\Local\Temp\413294754de9d69fdd0024db23e8c5c4168dc0a954b24f14f6a9a888ed042f30.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
64KB

MD5
a9184e97a1845b23e224e60f9928874f

SHA1
edc94458454d33a208b6ca4b4501daa55fee82eb

SHA256
efa072a258c9aba4b0c105eaf7c31eb7af8f56c9a0d763c966072f0d1ca35e13

SHA512
31e19dec841d212f2fd079dea4ab66afe95fe00ec8376269bfc33cb8bdefda58541415c9ada980e8c326a66fe7fa84b8d042d3cb7fd0a97a5339401504abec4f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
163KB

MD5
ad925a8b7212fc60ca921cb1a12c334d

SHA1
6cae3498851f0b340bd457992cd7abf317055add

SHA256
611118b7f48f6088f01cbeff1e3c601eb9919a4d0d13d6bbe8619469d48b489d

SHA512
da4d5217267b25303c62896ec4af7ab3991fe1500495883444689f4d40d4cc9cdacbd7b4d98cbbc240f01e93c70f59d8e0febeb7f63759d8e00393ece354256f

Download Submit