ecf96271b9b02b800feed0f6c29b04d6c7a0118c831fef62ab71ec06359e70d8

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b4499670bcdea33ae6659c2b14d2270N.exe
Size

71KB
MD5

7b4499670bcdea33ae6659c2b14d2270
SHA1

0e2fef55e46c8ab32d3881359b5df60d2c20f44d
SHA256

ecf96271b9b02b800feed0f6c29b04d6c7a0118c831fef62ab71ec06359e70d8
SHA512

4cecf688e3f1e74c2e1d8205593ad069077374bbf2a40fd28aa09b22322b0b16a8939ae4f35418aa5bf630d1b6a256c343f8a826d4e8125e450f9dde47d1adb1
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxmNZNr:6pWpBwchcV2Wxe

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4527) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	7b4499670bcdea33ae6659c2b14d2270N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b4499670bcdea33ae6659c2b14d2270N.exe

C:\Users\Admin\AppData\Local\Temp\7b4499670bcdea33ae6659c2b14d2270N.exe
"C:\Users\Admin\AppData\Local\Temp\7b4499670bcdea33ae6659c2b14d2270N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
71KB

MD5
d1ce2b2dc770583794aacb188ed3863e

SHA1
4df5918dd5631425d678c2cf241ac55dd886a226

SHA256
a0b47488c28f68864dda785cc83d6be7f3204c8bfa6cc59ae2aa5fb09680b59a

SHA512
a9165081689ae7e98b53fa740b8ffa3f2c405fe9002e5c6868db9fedce29a99c28dc18c22c4f78c58662bf8fc585ef843b4d4e1a07dcf4454fbb71473aeff0dd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
39cd8b7d1d7b66d9f6ecd66840c10886

SHA1
d0cf48901182e906b9b5df294eb5c444ed9828ee

SHA256
10641b3d6697b8a64631b293238968630d2d7f513dfdbe846688d1ba61835165

SHA512
5e9abda979ff258e5ba8e8d6ea445d19166fd8d5bcb8c31cbda8c8767fecda5c4343ee1c9cbdd0fc498ebad5425e115f0efc0d9bf74257b853ffbfeeffc97834

Download Submit