efd87d69f563f557a4669afb106fbae11043432e6725ea4834d0bb049b2cde1b

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8170d9cdef6d8b3649d6dc961974490N.exe
Size

102KB
MD5

a8170d9cdef6d8b3649d6dc961974490
SHA1

3e8e052953285fde5181b99cc17c3f9caec240f0
SHA256

efd87d69f563f557a4669afb106fbae11043432e6725ea4834d0bb049b2cde1b
SHA512

0944b921e92881ce8587e3528260afce921f42bd43e1a75dcf01402086999889700e3c1593a7a5fd721b658b3b20bd6d56cb5f1ea1ea8a80597c39c391e3f62f
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPIUpCUpiPa:6DWpwE7oL2e+efZwZ08i8X

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	a8170d9cdef6d8b3649d6dc961974490N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8170d9cdef6d8b3649d6dc961974490N.exe

C:\Users\Admin\AppData\Local\Temp\a8170d9cdef6d8b3649d6dc961974490N.exe
"C:\Users\Admin\AppData\Local\Temp\a8170d9cdef6d8b3649d6dc961974490N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3036,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
103KB

MD5
f7fc6cdf27008c2b1e46bec249948117

SHA1
59415a5dffe9b7632556f0dce899987b948e079b

SHA256
ce82aac83f2176bdf686d696f07df599928a250ee1cca8452cd329e1e2cd9a9f

SHA512
9a5ecda23252f6683117f7b7cc3a321044a532ceabdbee5ea064285f6756e8fd0a23ea1e9c3128d7ba7ef287685107d4a7bfd322858aa2b9176d3ce4ce50347e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
215KB

MD5
b4b9729f8303e08cb41a18522024e9b7

SHA1
4bdc3c8b0a8470ec34777db5cc33b3b63989555b

SHA256
ecda37077f80469393a731d708119c070be8f3744ba81cce25ecbae3e64b3873

SHA512
4c932a26a303d1a604aa0f077117a26d4d8015d88ae7bd9e71b08503c7112d47c81c8c534efcdca48c6f27fd7b3ff53ccc3d0e1bd8ca36975fff5afbf78b7405

Download Submit