9d56589ac10d0410ed2ef42bd7ecc5094a120e88fb81a9b018ec482577ccb8c6

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7521efffec73b2ff04ead308ef025020N.exe
Size

54KB
MD5

7521efffec73b2ff04ead308ef025020
SHA1

5e5c9124d6675114dc704df701531326e03ca7f1
SHA256

9d56589ac10d0410ed2ef42bd7ecc5094a120e88fb81a9b018ec482577ccb8c6
SHA512

41b7174988829e9df8bc98319237e837dbb7f0a3fc1ba1123527c18cc350abb23965a6d565880f9ce9dd9a211c528bacc79461faec4b3e968315816703de4e67
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7+jLni+C+L:W7ZhA7pApw03vR03vCni+C+L

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4636) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Crashpad\settings.dat.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	7521efffec73b2ff04ead308ef025020N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7521efffec73b2ff04ead308ef025020N.exe

C:\Users\Admin\AppData\Local\Temp\7521efffec73b2ff04ead308ef025020N.exe
"C:\Users\Admin\AppData\Local\Temp\7521efffec73b2ff04ead308ef025020N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
54KB

MD5
191b74467a91497749280a8a289940d3

SHA1
6276b0b82a43bf395787a509084c35e3d89256f7

SHA256
3691b8b29117108ca9e669c6ab642805ea80aaa5a4c9b488b2422f11ee937027

SHA512
3dfcdbb2834f0b8d956f93b7fc5957a0581b7a40ef6a3f712430585a17a46c420e6de0ace053e0608588434f1f6b441b639826950d21c5184cc4560e98e46939

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
153KB

MD5
07861a6414392c7708c241281a925dd1

SHA1
00a3ecdecb95c5de6080853f315a66b5a309359a

SHA256
c05ee9ccc48a56a2499bcff4db37745f9dd35025e96648a3079c698010d074a5

SHA512
a0fc8e51a8dbb3a62520f4bda7c6a3d39be7dfb8f75a704002b3d6d7d94ff2feae7f0e4bc925584b4e2e648c9f14b2e3040c3ed33c8fc8cbb82200ff626d7015

Download Submit