c107f3d07434f107c24723c0c023d30cc129c63d414818bc1c7c534a66594f3d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa283a8bee62cd5def0e7557986d25a0N.exe
Size

42KB
MD5

aa283a8bee62cd5def0e7557986d25a0
SHA1

7e32ac04aa02909c2a087d034ae05ef271a6b023
SHA256

c107f3d07434f107c24723c0c023d30cc129c63d414818bc1c7c534a66594f3d
SHA512

58261babe604ac2e3bb9e04530f3d6cf7f0ffa0360cdafbab2aab49d8361b3f35124b1c28e192324ad0599489ad02acd116fd0791ccb243d9a8416635a79dba2
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJL/:W7ZppApBULcfpHLcfpyD8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\DismountInitialize.vstx.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	aa283a8bee62cd5def0e7557986d25a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa283a8bee62cd5def0e7557986d25a0N.exe

C:\Users\Admin\AppData\Local\Temp\aa283a8bee62cd5def0e7557986d25a0N.exe
"C:\Users\Admin\AppData\Local\Temp\aa283a8bee62cd5def0e7557986d25a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
42KB

MD5
ee4b4d5e00a7b6f8eb6bc2ed058c0721

SHA1
19e48d81b94c13a814b937041db47cb4658fcbd2

SHA256
7159bfa4956c0d41147ff14b8b535a8e5667e8af1f5afd9b0acfd4dc648ab4a9

SHA512
31a17fa2a4546ee158d0453c7556df4e9c97626ec5137c9ce1810680b24858cb5c8d1bb120ffc80f67264d2f1cfa0da8abbb29bb7d9c879dd0a83ef14114fdfa

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
af78751ee9984c51a4ff98b21aaaf222

SHA1
f63ca05d967778f05a19b49f3dbde37edceecdad

SHA256
a767ec97b55eea0df8d59baae5323417e4dbc532d6a8666d30405d178d3e278c

SHA512
ce3fa47923b94019ec80e8ff2cfa8f642456716f407c77ef8d48c28b9db44cff4ab235d1b04925e65e559c122442a3bd49ec2c6a03ef56dee6a570cd07575986

Download Submit