16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
Size

37KB
MD5

155e2c01b64201fa68a3fd094d2f0741
SHA1

6b4da082998c289768019eb4b7a7df1e91b2fb35
SHA256

16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5
SHA512

8897ad719ce3d3669fce576d85146fd7d5cdc8f7f225508702702b11cea2da3e217225ee7dcde54d18e5a7647633b2221ffbb0462b9c54fc08b6732573972c69
SSDEEP

192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxje6OMmy6OMmIkU:yBs7Br5xjL8AgA71Fbhv/Fzzwz0bNs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe

C:\Users\Admin\AppData\Local\Temp\16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe
"C:\Users\Admin\AppData\Local\Temp\16b97c3324633740036df70b8ce687bc227dda65288bc404152d43aa4a5226f5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
38KB

MD5
13577ba3fae096e65341edb63bca6dea

SHA1
c826bf19a21730d42598156a51ebfed9d83cb2e9

SHA256
3589c38361e4799f635becbc3bc2af6a4c8038c907067c9b73a32ed0da29fa8b

SHA512
e039e2c943cf4642cc347dc63a977a568b310dd51d66e2d0ed8e4263b3c1018310399388606b08fac1dce173f5868eb392006acf1e6dc3991d60b673c0f61237

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
912783e9481f166081e559561ae8943f

SHA1
bd00874aaf0e68733bd5eea7f29fac131e59f508

SHA256
6fb5d5fd880597af3fc6ba1b7ca52bad8ad6c9451c6d47d876aa7eadbd5ad1e8

SHA512
01d0b7f4dd01b4f699d08f9f9ba17ea01b02010423375717e2300795ee9c706cd3e5d29cab0b9ba53f3a7d8c7d7b1ace879ad086a8fc570f9f23ff526fc04dee

Download Submit
memory/2600-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2600-1960-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download