ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
Size

94KB
MD5

bfff451d0911a3ba67db0545eb1deb73
SHA1

242f040a99d2b0b9c665eb89944f7933dca3819f
SHA256

ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a
SHA512

5c028f9569632feadddf8ff6a10d807e82a6be446299bb9e0ceb8bbfd0117566c00c745daf98eb38205bf381793a4c79f3cf921fae8042c8b25d0d5b031de763
SSDEEP

1536:W7Z2sspApGg7bobSM+t58qKcAK+j4nI4VfNgZ11PED4gJQeAAUZa0EzOM6:62ssWpGgrM+t58qKcAK+j4n7ByeFUN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4917) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe

C:\Users\Admin\AppData\Local\Temp\ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe
"C:\Users\Admin\AppData\Local\Temp\ac1fedebb66bb140fd0b127f0ac835fcb9818aaf8b897fbe8a0eed9493cf168a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
94KB

MD5
3e04f8b7dbc8f2107048ecfc1ead8215

SHA1
894bd9d4e113fc34410696949700d1d21133391e

SHA256
047625235a4b4fe65bd4256cf21064f108ccaa0f6c81298cbafd200bbe8b7dcf

SHA512
6fc4626ef70fb40b90f06c5233774bc7e6b26d02ac922db79663e363fb9e64b931aaab021c70364b405d1f61198abb971f22153069f03a2fedb9305d8bda714e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
193KB

MD5
03563e4aa3d6d777367991b71a731384

SHA1
0f8822de0b88f91958d5efc2e004ad67b0eb5a23

SHA256
066d66248143bbf5e620e904d83486ecae4adf91d8892ec577e8217cffd81d7e

SHA512
b132c1518c272876a1a78b054729eb14c802e91a1ab0d5fd787bebf307692fdcca3b81f93360b782b62aad8b33adcddc49bc5e663e9312b5f4177af002107917

Download Submit