0ef7c5bced76dac22162cae32eb81bfcb4611d4cc777e0f8585d9cce4f55fbc6

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f761581b7d46004780711d50153f9c10N.exe
Size

43KB
MD5

f761581b7d46004780711d50153f9c10
SHA1

5bcce092bbcf124c934bf0138698e164e53f1335
SHA256

0ef7c5bced76dac22162cae32eb81bfcb4611d4cc777e0f8585d9cce4f55fbc6
SHA512

2fd8dbcc07822baeb03d155fac61153071da0f661f81854e24f956633e9b656c2a088d833065fa4d4fde85600ad888b6c3f7c3361171b8381c8982f107149d96
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOHwOoJVO7iJKqOxiJRDOWiJ4JOAiJ/rOqiJv:W7ZhA7pApM21LOA1LO2c6b25gc6b25up

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	f761581b7d46004780711d50153f9c10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	f761581b7d46004780711d50153f9c10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f761581b7d46004780711d50153f9c10N.exe

C:\Users\Admin\AppData\Local\Temp\f761581b7d46004780711d50153f9c10N.exe
"C:\Users\Admin\AppData\Local\Temp\f761581b7d46004780711d50153f9c10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
43KB

MD5
1d60f57f93fd6c42a85d0030a10cf4f8

SHA1
02c55f129c0cdbbb79e00b8812f3188cd16fb65b

SHA256
0cdfe33ae675536e7b89454231de57388d5efaf5ef5eaabbfa0af1a79becd697

SHA512
27be76462aa8aaa593bc8d72db8d8e74637ffe6751576475c9f042b4cf04d5e2abdc01875bcec724b25d1f5fe8b1545077bccc26925a538c80f678289bf2fb5a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
986c5dc6199e91f87f580cbf1936be8e

SHA1
c2a93b972677f129fb257c6f8849e084789f74b2

SHA256
2058051b1dbd5a481bd976ba86a0a4fbac7174aca405351782e52d740dcd6c6d

SHA512
75d2bd605651a068c4a0e6cb19d6a6b3cabb53ed46b6c00c8d4af0f6e486cd2eef94d611729d5688361a04170922eae8b61c96e41059027254ca0695a154b063

Download Submit