078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
Size

53KB
MD5

685b6bdf43cc9061c4353ac950ce3475
SHA1

ef27dbf0cbe15263310db3461190fd57f20474f8
SHA256

078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3
SHA512

b755de087f42f792e54c570b71bc4713a189ee2e494c406af2e125772134396210305d7c9137f4a255a3a6488d4cb5623848c36384a823af9997c9bb1c6dc4c4
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJwNqikTqikkvPVvPL0nyaT0nyah:W7ZppApyqikTqikKabah

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5058) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe

C:\Users\Admin\AppData\Local\Temp\078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe
"C:\Users\Admin\AppData\Local\Temp\078ce15179a2906e67e9e0a5c2d4496154bc72699aea182295fb3adecdd452e3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
54KB

MD5
682e06e45050d6ab82fdf70c1f1636d4

SHA1
8dc2e95ea97676e14da4d2fc800b2a417c9bf7a3

SHA256
96bf55e8ba1961018b85f845d104534c8adc8ff99f8d8e26bd7f16c70f3135e5

SHA512
a08bc43346177fa78f58b5bad464b0f58a64098a42953de3a32ebc1a7a904c3dcbbc862d021e6aa1570b7c4baeeaa9b5008121959f812e3fe8d78ce00ad63288

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
ba8bfcddfcdde6e94fcb46030dae05ad

SHA1
feb085b81954b7fd526c8c60773382934cc6ca1c

SHA256
c096bb5469c6abfbc2fe592c8826aaa10ee52a06fe1296cfe21fb9afd216f923

SHA512
2d2391978b92f33ed93bab5d9a2d8a1997b97ee1d28df10a1311f5fc6e43846f7ffeeea501bab6d022cb5bba17acb5008b828aaba841967d10076b3b4e3eeb99

Download Submit