a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
Size

68KB
MD5

e006812a35736ab32b116583b216842e
SHA1

9a1b193a6b485a58a657d31c8fee05e3c9407a4d
SHA256

a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c
SHA512

5cf3e2c8c380d4edd6901e39df75d72214a1ac3c54da42d7427cef538a67532153e0477b086011bdfdef8b0c0de2702e1aca64da10448afec6355f7cddde79eb
SSDEEP

768:W7BlpppARFbhbt7Y7WBp9/Bp9S9dr8WbTr8WbV:W7ZppApRhS9f

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARA.TTF.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe

C:\Users\Admin\AppData\Local\Temp\a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe
"C:\Users\Admin\AppData\Local\Temp\a67229ae69e6293ec90eebad2170d45ba0a113df4e89447544f3b7677c00241c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
69KB

MD5
682a2e80de6c3c575f8ef42fc4569dd3

SHA1
a5f4e159dd3f5d97eb698becc7de28bf0145f9fe

SHA256
215a66ff13f5d2c5edaf3ff896a2af8e6b673b2be1b65df076dac19b7312ca9f

SHA512
c1a72b31dc36b4e48e1bc9b833e7d65cdb1947189928e2a968ec55a621692d471c313a40caae55b2a0bb9c445e8803d87e0f46122b3fd876f7d5e7b1c6917805

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
51cd8218d09238c357e2322477eaca21

SHA1
b04c261b630a13b49d1403c6b7bb32499cbb029c

SHA256
85b357d821d34109a1dd8e788a00cb2e1ba6e975543ba5e150604f053984cbf0

SHA512
1e88dfa3d8c8197e6eb7ff4809c8369404a8bc129885980e7b5fa8e34f2bc71250cc805a878c07774d554f93112fc866785413551d119e10d27e98142c42aaa5

Download Submit