1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
Size

58KB
MD5

000fc5c08cac72370c62248e6518c5d9
SHA1

5430486bb851f32616cbef551aa9d04cf6c2ca9a
SHA256

1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1
SHA512

c677a332e85c8d3a876ab65db14dd275ca0779fdf43aaff9a1cfb7c352948cac33f88af9ac38a6e54e6a8b864579bc9a77611e0a12259b7363101a1596c2416c
SSDEEP

1536:W7ZppApBULcfpHLcfpyDoA4WZwXwqmdGwmdG4:6pWpBwchcwDHwXwI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5008) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe

C:\Users\Admin\AppData\Local\Temp\1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe
"C:\Users\Admin\AppData\Local\Temp\1df257410ba12be3e37d3156eeaaf27d68aa8f2db7c0f9bcee4454fe9fcb1ec1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
58KB

MD5
efa9ea0ad9a2db0dceb943a2dfb3e805

SHA1
88d4557bdb907a86b057a5e00b85c2b8979875be

SHA256
95e1986b050efe24be626710707948f44c15f3f52215d2171de02204082e9714

SHA512
b3b422f99cc2dc1a47ff43f8fd024095180400a824bee95716b2b83cfa8df29bb64d83ad23ff3ebc2e4b4a6af6abb96dc3d0164f862a51c5759efb07882438aa

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
157KB

MD5
bbbda24ba490c3d763cf3d6483140d5d

SHA1
a0a7750f38349fbedba815946bb84581fb006173

SHA256
2b507a1ba10436434e004e2becb3fb90d5e67756e7a6c6187ec2aecc2fc1a5fc

SHA512
1fd8d7893d3261b8a7f0246b72be8c065d1bfc340b4b530641f89a0bf013589f4edd282594f22a93da9aa3e16e85b8040d69f2dcb499ffe8354acae1a74b24e2

Download Submit