6cb4757c063db4636535a82f7cc41d7871e4019f949d2139377127e651801f53

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e7d8258c892f4e0fd5578b033567e20N.exe
Size

204KB
MD5

7e7d8258c892f4e0fd5578b033567e20
SHA1

e399e1e7926aea6032d3f3e0bfa2d0e11adc2450
SHA256

6cb4757c063db4636535a82f7cc41d7871e4019f949d2139377127e651801f53
SHA512

7911098f298cc352bd2aa4776337ce270849c3904647bd062c1f4eb8d5d00b25ac7f4d86432222e868c67f25c1602d7d1d027ace56b655cfe02fbb942e6a98be
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzky:RqKB+tOkWKR0iJ0lTzky

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	7e7d8258c892f4e0fd5578b033567e20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e7d8258c892f4e0fd5578b033567e20N.exe

C:\Users\Admin\AppData\Local\Temp\7e7d8258c892f4e0fd5578b033567e20N.exe
"C:\Users\Admin\AppData\Local\Temp\7e7d8258c892f4e0fd5578b033567e20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4240,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
204KB

MD5
c6bde66a9e28aeb72d5d696c908f6083

SHA1
a612a5a9d16f4d1aaac5822ad5d3c9d5c5d0b683

SHA256
213975ade0fec3ce83eabed33da0d10560ad5e2e91b15cc2e44a4c0c17383e8d

SHA512
1b8bf013391992d9ee860c5b3388bb0748c4b7bb0b422f6e6dafcc57eeda4e38e10acf5832ea6c4aecf18f96d5533962de2fe467c2dca1517eb48dabb8dcb01b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
316KB

MD5
151892efc7d05646071204ac342fcb0d

SHA1
593bb7f66e25d946e3e9f22890635138c07707ab

SHA256
730957a70bc2a812736c85a248b6fbb92553e17bc6096155c56cf0ef9eb49357

SHA512
dae65995568a2a2f4bce71008203249ba2c5aaa3a631b2b105ad3dfa2fc60dff25cf1306b234f62205d8f5acbfc82462f7a954454ad0471609c327efaf77daa8

Download Submit