5eb157448dd2687feb6f7216176710e2256aaa84562f8c168bc9dff7d908bbd6

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

71cc07b0f7caec92e388f8895e0a7990N.exe
Size

30KB
MD5

71cc07b0f7caec92e388f8895e0a7990
SHA1

d741b6a568352ead916fd865b7b415ef1b40e64e
SHA256

5eb157448dd2687feb6f7216176710e2256aaa84562f8c168bc9dff7d908bbd6
SHA512

9a9b138a4dd713a3e73afea790a53003e8bb4eead76f104f3eab64a4c84b8481fcbc4aafa24a6ff191d21ae2395541ca5295fd02e7a370b01d1633bdff6a8578
SSDEEP

192:tACUADIY0Br5xjL/ScAgAQmP1oynLb22vtPeGyvyq1iGyvyq/Z0Z7:GBt7Br5xjLfAgA71FbhvtPckZ0Z7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4658) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	71cc07b0f7caec92e388f8895e0a7990N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71cc07b0f7caec92e388f8895e0a7990N.exe

C:\Users\Admin\AppData\Local\Temp\71cc07b0f7caec92e388f8895e0a7990N.exe
"C:\Users\Admin\AppData\Local\Temp\71cc07b0f7caec92e388f8895e0a7990N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
30KB

MD5
8edd982b7939de8108af80be78987546

SHA1
c37085c272f829207137a71f37a8d69f0f4a0be2

SHA256
8148e90f7383df61eecaf8f1854245cab503012d9254823998055b3fa775b697

SHA512
dfb15a4921c7b43a57541f5decf2b6f95e505ed52b930e5d8377d1ff1b9920b66b40e2424652f6b2e27c7ae0101c1a0c4bd5161225c7da6bb1340602941189d1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
129KB

MD5
846d5a091158c478416f69729ecbf6f2

SHA1
3ae1ed075a2488430306dffa5b8a1f365e923acb

SHA256
fd322f442be7cf9de76d3bc45bd336c92f545882b268b806750a6aa3fd51d6f8

SHA512
93d269f6dd7e77647b0189b9a08ac24784627202d040fff6042dadcff9bc6b50366d6d746fceb56ded37c82a2ef41f97da71d760d6dfeb9fe65167d544864c3f

Download Submit