69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
Size

187KB
MD5

5f00a2e3629e3772b4d751aa23b30db7
SHA1

1d9a6f7e96ccbd9895a62e13ebf16fe5ccc28b31
SHA256

69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4
SHA512

2daa3c4843aaebbc67113aa176182268110392aff072752514f0e60a15cae5d062e73aff7c48d345e4878caedb6b5114a0fbac55b770a331833562c9361cb617
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBgnW5M:RqKB+tOkWKR0iJ0MnW5M

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4669) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe

C:\Users\Admin\AppData\Local\Temp\69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe
"C:\Users\Admin\AppData\Local\Temp\69b564c65cc13a4475dda956a07ffc448200f55a19c7da259bec544d62047ef4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
187KB

MD5
0acd2e400669b887f8b5f9ef6c7d2b1a

SHA1
ba97cd99b9532a9687439ad288dc26f09f2d83a7

SHA256
4b4f2ee2f6c766d8620e25eefface9c4ec6c0edacf1bd44c53aa9280dc0108b0

SHA512
0da90aea42892bae562d1243b8da348200092a7962c1769c46bc0dabdf20dc7cc45d74878ba8accd09f58263928d9344377627a5ec7c14641e39cec803524a9f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
286KB

MD5
ea141d9315dbb20af65ef08ee3719b04

SHA1
cf6a5199d6173b53eda147f04138396981a0c2dd

SHA256
316d8dd008ddf8c7026f9e602a9c34458ff290af92b4d5feaa83b9cb7e7b8aaa

SHA512
257686c9053308ec1e9dea92b56d01aea98f1d7e3a1c3c09759ee9f1939eadb9afa28bca9573dcaeb54aba38ffa75c1927f10aef9b158f3069f4a296d5747f65

Download Submit