80d3c315c6e0ad5e9fba75282a709ac2a10be76df3ce015aefe3f30e4e026f89

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26065b3d721f765273fcf0076fdd7420N.exe
Size

47KB
MD5

26065b3d721f765273fcf0076fdd7420
SHA1

4248e1d117beb77a4c10bb3a3b09311d015775b9
SHA256

80d3c315c6e0ad5e9fba75282a709ac2a10be76df3ce015aefe3f30e4e026f89
SHA512

f3ffe241259a6f32b040ef60e0a5f7c126fbfaa12b3cb06c21272eadc92e7f78135cfd77572ab796fb250f4359cd134136be4e666abedc065525e707a440b3e8
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/FzzwzgTAUAcfqg70sL:/7BlpQpARFbhNIg+sL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4671) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	26065b3d721f765273fcf0076fdd7420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	26065b3d721f765273fcf0076fdd7420N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26065b3d721f765273fcf0076fdd7420N.exe

C:\Users\Admin\AppData\Local\Temp\26065b3d721f765273fcf0076fdd7420N.exe
"C:\Users\Admin\AppData\Local\Temp\26065b3d721f765273fcf0076fdd7420N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
47KB

MD5
88669d8887aa873c6ff9e978d679b4f0

SHA1
cd78061a950941e76d1723226be5d14b8c47a893

SHA256
b76a4f61aa2eba1484cea0b4bce863634902548f0ac5f7fc087428bf461ccd95

SHA512
60114376370b8360158e9c35528040c2fab0f9140654fecca2479710fb3e23be0256d3c0142dcc889af9a415c06f6e575fdb382fd92061b160f7d6370aa67257

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
49c95d5783b48a7ab025c6a2e79df1f9

SHA1
f8341b7574157dc63e74d41b3e06c39913f6418a

SHA256
969d8c6a74f208062b58f6f06009ef73ecfb4a170d7408e87305241649af1eec

SHA512
d225ab15b03c535ab30eb6b3a1ddda9272f9971bb232b5110bc2b1cc25eae3e780d47fdd0c25d9efc77f657c98d40cedb0aa985103dc1b436faaea2faf33adc7

Download Submit
memory/4932-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-1004-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download