261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
Size

52KB
MD5

186dd00ec36da5e39c1c88c6da79655b
SHA1

e933927692e33c7c102a8d2c17954ec65b2232ce
SHA256

261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760
SHA512

1c5f7f6c99299ad59034a188dc5b2af844b647cc886237829a03603892a411cfe82da84e8f12798e409ed1821ea4a0d2025dd50836240e803809629bc99098ee
SSDEEP

768:W7BlpppARFbhwEnAAJ+AAJbjyjuhPitvtu:W7ZppApwEgyaPitvtu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe

C:\Users\Admin\AppData\Local\Temp\261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe
"C:\Users\Admin\AppData\Local\Temp\261be870183cf95c0b630a792754713897058029d6501fd679b63d3d84697760.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
53KB

MD5
ee4864b12efc88f7a2188c6ac45aa335

SHA1
53b6ebc83b4b0d12468e516e4f0379d5ae5386f7

SHA256
b91f0c9ccc32e0f1c739c99d0f43986b4802a653e9a942ed68a2939357795e83

SHA512
23b0b4c2d3f2676e33f81341ba77a372515b275ae0b2eee5baa3b47c1fecfddcb19ae4557be56084c8affc942f128e95e8c96297ea90906781e89b31f41de987

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
25d4e6480c216470e7323b2ea5a9e7a2

SHA1
379a53c9c6f326b829d89c57ad3865829dca1b86

SHA256
1c987b37675d24d899082e6e66b0aa995bfa39759a5e3c925e40767841bc31bc

SHA512
dc822afd797ba499bde0027a4c2ff4f41b303042992c04a6d792565aa212fb0044efbbcb1b19605b4989955d0f43667b4f68e54e39320923d32c034f8923a246

Download Submit