7a71bf819fac885e6fdaa50f305c20270a9ee7da078d69f81aa48f4e1e18895d

Analysis

max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83a6ee3579f838b867bffadf9c531b80N.exe
Size

69KB
MD5

83a6ee3579f838b867bffadf9c531b80
SHA1

bc879cf071dfa0133d94cb87db22287b13f7742c
SHA256

7a71bf819fac885e6fdaa50f305c20270a9ee7da078d69f81aa48f4e1e18895d
SHA512

b574196a4a741f72b856a79a443f6ac83d46e68251151569790534793542f42070674e5097b6d6f407caf5b72ee8d6af04961560b890ccd2669b9293d08ad385
SSDEEP

1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8aPtPfgNP:62ssWpcU7lK1lKgkEgNP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	83a6ee3579f838b867bffadf9c531b80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83a6ee3579f838b867bffadf9c531b80N.exe

C:\Users\Admin\AppData\Local\Temp\83a6ee3579f838b867bffadf9c531b80N.exe
"C:\Users\Admin\AppData\Local\Temp\83a6ee3579f838b867bffadf9c531b80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
70KB

MD5
35e0c34c4e97389099dd12e50763e622

SHA1
c37588b416ff4572a32767c788610c48df8b6ae8

SHA256
b7186a6e42c91672fb07fd63a33c3c9c3105d46490ad6051c9032c7f4efe8fe1

SHA512
c147f4f88b1e710757d59cdff4d8f73bb47732ed27b0d0f9f53b118b7b4e43fccafc59f9f904eb5e69425f69bbb29904d29443397ced2478a2d445d8aaa8d4f6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
f255bd746cc2abebbda9c250d07c09fb

SHA1
ae2299b3f33b19993209bea977f96ab29f7f8429

SHA256
3d9ccab7cad7f3e410a5aace9c496bb43372bb21c5fe37d5a960f7b0f9e58252

SHA512
6504cd3a6cd8882da8f86ba4a30fd5c45619542e14e2061106ee5cc8a0669eb25f9e42538b32cd7de7ba7690104559c738a3a86a31cbbebafe330d57cb915685

Download Submit