2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
Size

50KB
MD5

79353554f425b8f4901f9aea7008b714
SHA1

e3b9991b2fe9a6054654d295fa07371dfb23e14a
SHA256

2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62
SHA512

d861d5582df14ffd5276da1e9593f612be4006faa0eb29d5c632d47b0cd9ab9046fe8b461616958664f590cebf700ed18724a0b9a50cd895ed483389d320c916
SSDEEP

768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6nM6G:/7ZQpApmi6ns

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe

C:\Users\Admin\AppData\Local\Temp\2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe
"C:\Users\Admin\AppData\Local\Temp\2818d867da7b05d2df9a7d13c365606e01253ada40b092e53fef6d16e0ce4c62.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
50KB

MD5
fe3cf613cb32b012bd0101dff4a0c547

SHA1
6513dec4d520dabcf270b27f78f675e58e885608

SHA256
29bd8021f6c4f9410a46dd430e299504da3136b5581c0412fe215ecd0a6deaf7

SHA512
63b11121192226d0ab3f973f7ccc3efd520425aae90239ab82eeb7fa3471ba4ecdebc21f92eccdf98da5f4836d0e90159b0078296fdf64cfb3b28638d5434170

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
6342bb1b7870469a59ea3a796ba09723

SHA1
57550f1d325a5e583dd81fc5fc392a2428e88e43

SHA256
8c8dca80e9ff0aea68124817974b7ce808184bcca7c1b25fa84b2798c5ffd9dc

SHA512
55c58f2537824a8d61fcb876bddb351b51fbca95e06aeb511b905c8b0f6f4caeee54bdbec9ca9ff1c43f2ac5715d143e6212321ec2b43bdb43e97e1a98cdac06

Download Submit
memory/3440-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3440-914-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download