922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
Size

195KB
MD5

8261a3d48b3466c5b4fb45e6fff62f6a
SHA1

35f976d3cb60262640e61332911baa04e375ccc0
SHA256

922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051
SHA512

40961bbdec1cf012be0438abf5b93c19d5639f2b6ba85beef62b24e4ea04b8bc88d8d013657b72fb830f354ca335db48aaba175cf07e67fa07bbd017141e394c
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkmKd:RqKB+tOkWKR0iJ0lTzkP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe

C:\Users\Admin\AppData\Local\Temp\922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe
"C:\Users\Admin\AppData\Local\Temp\922e66e6ec237982aec2ecd994eff18ca3b617ceb3a2c49ab1fbd297ff9da051.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
196KB

MD5
f44f87f569ea83d3bfe536e8b0ce3adc

SHA1
ddabee9d4d62592f18d8b2fe9fbf37dc72ffa725

SHA256
3d4c75faee93c93620577d1c9b6ac59351ab88349296644ddebcc3429a918b6e

SHA512
b0856d51e545521896887be9d2230042dce195564d34a0479199d74518a2ed69f40f6a785d109941b4c8a4da8aa01228ed060afd78bdf99ada43ebd60a0f4cec

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
295KB

MD5
348e74eca8a69d96f4b96c4522598fa8

SHA1
d50c7d6f9b7de52160ba2fc2c0c36cb95d1e5362

SHA256
4897df852d4a1f651be415e6858e1c4e33fbf5074b7f81bd162ba5a891bd503b

SHA512
6df0db91913618e011422e6909a2346c6162e2cd0dd2298042d356f174fda9a8b1d1750943edc3cc452e630d7900920aee598c1c6354c5f98cdfac712dcec5f2

Download Submit