2aaccfc33d3257421afa3689e0f04190eeb45cca2331fde7f8b926a9b4adc84f

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

52a0c82a128e0c312feb2bd2dbdd5d10N.exe
Size

74KB
MD5

52a0c82a128e0c312feb2bd2dbdd5d10
SHA1

fd3d5a56012a9b5057dae00690ba4bee82d7fe5a
SHA256

2aaccfc33d3257421afa3689e0f04190eeb45cca2331fde7f8b926a9b4adc84f
SHA512

73471f1c3ab3a44b6eb759777e64e1cad1a4ac060dee60091764fc6e8a67544d4c868496bb698b1ff06af4d54f96ca72fc60c001ba688db606125405d616dd12
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw70EXBwzEXBwcJdkCKPuJdkCKPULxNmUgbLf24Lx4:W7ZppApAJdkCKPuJdkCKPUtNsO4tNsOk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	52a0c82a128e0c312feb2bd2dbdd5d10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52a0c82a128e0c312feb2bd2dbdd5d10N.exe

C:\Users\Admin\AppData\Local\Temp\52a0c82a128e0c312feb2bd2dbdd5d10N.exe
"C:\Users\Admin\AppData\Local\Temp\52a0c82a128e0c312feb2bd2dbdd5d10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
75KB

MD5
3b813627bd80007ad4b7fff4834507c2

SHA1
a9369415d06f2ec34d6ec0e8630d3e4f0f802bbb

SHA256
4f6e217406dd4499cedd2a7c0d5338c8e6bb8d7f6a47236a091a6de4e5185c99

SHA512
c48315f008ea9202482b9f1e93c839f6b306232dda109fa5203e673e5ed5cf6c09a97d996ba807f275a14d0cec69de05814f04ebf7ce1a9b2d13e9d3e9ee81da

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
370b0e7abded244d9c7db7f5768946f1

SHA1
c71d2bc0c8360dc463dacab54e6caa4055fe30a7

SHA256
f056b2c35fab5f207f0e22dc723859d9ca0e4d9da90a752ed8ed83eb1a5d00da

SHA512
737acdcd8a8ee72c50d0c2f3873811dbc50904a09832b3a7b5b0104c69fdcf26a1796f2c712df4c4c458f9bc5232e0f3c2babc95bf8827d91b8c5ab1a84a2475

Download Submit