091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
Size

110KB
MD5

5d71b86548a474a918dad49908fc948d
SHA1

cd0be7ee339d002aee6242f05d60e3ddaa4f3b13
SHA256

091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4
SHA512

2cff7845580502f45f673085a3c15e96eb8d62c3aca3fa9af0b454ea9e1afb291efa5178c697fc01955055acea763c3202ffaedab865cc692e050570961e8657
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBw:PqFF2Ie+efsim2z

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4853) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe

C:\Users\Admin\AppData\Local\Temp\091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe
"C:\Users\Admin\AppData\Local\Temp\091b2e170d848713d11193a3c22691d84636d430f86da67f6a8da6a6c5669da4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
111KB

MD5
0c98a507b6dafe02a871a10e6a3a93d0

SHA1
3fc8c9e69198e48e5bb00bdad04c001777f6d48e

SHA256
787a4bb71e4d7cbb09d39baf8d3c16c4e60e6568274045771fd12a5429c163f4

SHA512
46f19f630fa6892b37c7599a627922e06a25cb7b0c4e3522f5ae742265f2dbcc19eaf68038d596bb30bf4e31d7daf136464a82dc298f1796314f893249fb2107

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
210KB

MD5
b29f0716e4636fa192427079b5061b51

SHA1
801445715c839d2a0031d139a030e5f9b98fe38c

SHA256
2821540affa775e3a93aa2b682b3981b5742d2425e1c7e951287279b220fa035

SHA512
e63d9e94af154a0d90d964b3421ce222ff6ed4b3e722f0de2386440ac7d3c6476fd59f192f9bc0c89fe1fe45a0926a3455fcd9eb0679d06b17b3759b9b4b3d91

Download Submit