753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
Size

42KB
MD5

4db30db6d3d2f582d5743002e9072a68
SHA1

2e2b3a7d16a7d1dd69a90207dce33c5fdf61dae6
SHA256

753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5
SHA512

435d5abc7794250e3f72162255d9de56db80f850752241b9ab329d5e413f3230648e682eaf3cb65deb2750d51e69cb098541c9212c134603c0b9c56db2fd34ee
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLI3:W7ZppApBULcfpHLcfpyDP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Tec.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe

C:\Users\Admin\AppData\Local\Temp\753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe
"C:\Users\Admin\AppData\Local\Temp\753be9f98077e5dc0b424f6808ef570c9ea0103e04320b576de4bcef10f3e6a5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
42KB

MD5
7345808fbc7ebbf535f07ab5d76ee162

SHA1
d352939bb47ccbe44082e20db98a8cf86acc4078

SHA256
c5212cec3cdade332939ddef64f229f2b6316103c43ecc3016edb83cd75b5d0f

SHA512
49262ef842f8c3d4ff2a4df97a18329d5c782b5fe5f3ce89716f9c4edae1e310c8213f0163fc7c320ac93382f0e5d5ea93387b85e7fa57edee837443dfbf8889

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
e4b66e522cd6d6539cff5a51c279c262

SHA1
90d5c23aabf0fac28af9a5d9dc3b322e6273d259

SHA256
8073281e47a83b95e7f0ebfba0dc901471e43b0db7d8bd4003f36dd0b96f140e

SHA512
afb4b161bce8e7a0165699af4b05ed0d3be6948be7d4d08c5b7ad73bcd8d5f0ac50cd02b0b8281748ed60cc1c3288369ab0c5e20be243ce5ac1b6b7ee41a70c4

Download Submit