7a0cc2914d553dd4e8bd247c35048f9781ac367fab2556cc8d2602c0184401d5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

006a933f558841348f8817ef728b5fa0N.exe
Size

113KB
MD5

006a933f558841348f8817ef728b5fa0
SHA1

56f2d5471fe215a9a0fd93287962752595205724
SHA256

7a0cc2914d553dd4e8bd247c35048f9781ac367fab2556cc8d2602c0184401d5
SHA512

a8955acc1300f5ce39f2a86c6f9f510478418aed83c64d38de26b4e85021022473347c6429d73585126de12bdf4b58203c25e16c98de54e26adb81b90693eb8c
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBe:PqFF2Ie+efsim2V

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4997) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	006a933f558841348f8817ef728b5fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	006a933f558841348f8817ef728b5fa0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	006a933f558841348f8817ef728b5fa0N.exe

C:\Users\Admin\AppData\Local\Temp\006a933f558841348f8817ef728b5fa0N.exe
"C:\Users\Admin\AppData\Local\Temp\006a933f558841348f8817ef728b5fa0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
113KB

MD5
86d1192d3ef99ae220c0473744eca03d

SHA1
6caa9047ca8df9ff12b455227081690ceeda9780

SHA256
18fcb155b27f75e57bc1528a1a57c0322c0e96127facb5e806e1afd389f7866a

SHA512
c983ebe78c4f9e7610958906244e5e98fad2370546f0ac1c067d0757405ab83ee1b8be9ebf87e3f31446399db0c28eab4caf12648d80e06be82f9e70f8f2f0eb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
212KB

MD5
4cf42b6034d06104a0f98b5ba2612bde

SHA1
6071f08c486c9b7602c1fe9dccdb91ca0d90a4ea

SHA256
e2cba8c43f66712a7780eb4e904fddd1d75330cdf950ed6fc6ec20f780adb2f1

SHA512
77c2e7e78c1eb1a1c7a3db1a68376334b3f20e7ad4bfabb3e5853f6a47292461a4413e0aaacdc008fb8086558ed7e328898bd8ab840239bc8e75f3d16bd28946

Download Submit