59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
Size

53KB
MD5

1487ab65642effc26876ba9691d97ce7
SHA1

68b8dc1261315ce2d19c768adae7a0b53b7aa37c
SHA256

59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b
SHA512

c8707612323d9391eb86ba5563beba9e7eecd039c21b8905a7d5882727afe23b1c8c3d5e74739785e26392ef77b70d56f638fb365b0622c04dff26fe4a500f10
SSDEEP

768:W7BlpppARFbhbt7Y7wTCnB2ELEW0fZfIkE:W7ZppApgxkE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5060) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe

C:\Users\Admin\AppData\Local\Temp\59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe
"C:\Users\Admin\AppData\Local\Temp\59c51dc317e0451244406cd1684e5263611da4f0bba39effd77a8f2e3cd1006b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
53KB

MD5
b5c32820c946d0d1f629ca91316c19aa

SHA1
9d7872236dfdeff2613f89d5d5ccb8c8a70e87b7

SHA256
5e9c1dfe415ce69d3f7417f7f88a111f9f3a1e922074792ed057a8fe5351fcaa

SHA512
82442b17414fceac196300c88c488a63c9ec1e922680eb5e65ad337c8822669e3cf99416c8d9b2079bf3b8fa6f118c95a33fca96cfaf04d59c27c9d461edbadc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
4837fd81fc253a72882998bea41d2cbd

SHA1
f27654dc054d7e3b10bb21b18a9fa56cb38e544f

SHA256
4bc028b398536e5df2029126487ae4dadb3358f268f95e271bc417e67725f451

SHA512
e0bba0db180a87e45dd790af645439230bda7e929fcdbfe306121246c626d44c570576a3de2194fa9ce0452d0c2163f53315eda6a444a71f941d9a247e0cea34

Download Submit