f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
Size

63KB
MD5

83d4a7f9fdbddf45f24a5bce14db5367
SHA1

207e456e43f55f1588ba9d5f1f8ede85fce739b8
SHA256

f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88
SHA512

563a0227759fb9df6e6853030f52d84b7818e540599d1390f10a5cdd16e34e841c2050eccfcd33f92e26f5efcd603f0a28af463cf011894e14eff15a715d6a41
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/gzd:W7ZppApBULcfpHLcfpX2/Nw/Nwmx9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5036) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe

C:\Users\Admin\AppData\Local\Temp\f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe
"C:\Users\Admin\AppData\Local\Temp\f657b995a02837a6ef314902fe88d0f5612b2b6b0fe5a3b4d86e00daa03a2d88.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4340,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
63KB

MD5
b1f85a9a7fb72255caf21049ad903904

SHA1
f55e5865f57c2135b5f8d21215d9f606aef04c62

SHA256
b7421a552ab411c415afa8725b46ebfea40736cb4959698e06cb14bda3ff193a

SHA512
f3e25de8a83ec1739ab6ab4eda3eefa0474ca03efd2dba9a254f4f58b6f035ba6855e514e2e8c481c595407b3364b3e7579be87bd9424a94e4b09413984e97ce

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
175KB

MD5
990830b514258f81471a803198a86a3b

SHA1
5229ab6a50f71b8be3db4094d7412693af6bfbdc

SHA256
ead4d2a1a1505b5a27dfd265589732f118022c5157debd538f719c720b275a11

SHA512
f6448ccf3a9061de6d3a4f5f2722204eea584a5eb2f2a330ba28a63cdcae6181cbc0f80ede3adf0c83fdd185e64924a25e19f399dd7867ac68cd016c36074ccf

Download Submit