1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
Size

42KB
MD5

b75ed075f1449409a7ff5cf3044a5fe1
SHA1

535dddffb5b2c429963d0040cb5ee8225ceb763b
SHA256

1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640
SHA512

7dc92977706049c04277c70765384042cf5e890b2cb9bcc65ca6b9066f1906bc8ba21f1b521577c67172c2146b4825f39f423ea547f29c2471559d5c813b0532
SSDEEP

384:yBs7Br5xjL8AgA71FbhvBfepj3cfepj3KtLJilqGelqGk:/7BlpQpARFbhq1KtGFGk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Java\jre-1.8\lib\meta-index.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe

C:\Users\Admin\AppData\Local\Temp\1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe
"C:\Users\Admin\AppData\Local\Temp\1628fe1029ff235066c0a81a25e0359530f2fdbb92a953aef7dc5ef70e93b640.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
43KB

MD5
e4d07ebd5f872ad72e5a754031943623

SHA1
4fb10ad10ccac6c37ef310e50fd1109a2f97b520

SHA256
01c9a82af1386f825c22245e82d1a425ba27214c746d9382f13fe8165a8f2b33

SHA512
259ecc504baf73060df91d3e9babc2a4fd931e672ca8899f2c41adc3cb959ea5be1e3e27708cd54d02c8ed8e4026566410db41648e04413ea9d0a1ae9e930ab4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
ee55d0c9bba68d871baca4101e314aa9

SHA1
fb6fd2cb0e69b88719ee547d39f887767c62f268

SHA256
7fe54dacacd1a8bec3383eca99ea37d3493c2f2f59d6f5fc2a025a21c65dc282

SHA512
19ffcff3aa2a06a1255618fb6eb08b0fb0c6af9e4e9e01ca8a5254c13cfc0b3219417234713436a1ca1e30b8b5ef10ba046cca33abe3ed1a9d8f28cd084b9546

Download Submit
memory/4164-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4164-1018-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download