e553768f6864c8677e954370ba60e2782e63fd9be4e52a04bae03c72b90eef5c

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7616b0ee50d8e7c66787785d9666c4d0N.exe
Size

44KB
MD5

7616b0ee50d8e7c66787785d9666c4d0
SHA1

781ec1a6562260f5736edb7d33097e262644f9f8
SHA256

e553768f6864c8677e954370ba60e2782e63fd9be4e52a04bae03c72b90eef5c
SHA512

20d4a6a27341157ebcd1f43ff52b7fae653ccdf60094195063c58b7e287e3466cfd44ed80c40ade9f56389b9a6cfa2433bc7f04df7c47ced9937eab84a486933
SSDEEP

384:yBs7Br5xjL8AgA71FbhvPvD4Qfxd4QfxlQoVeDQoVes:/7BlpQpARFbh3vzfxRfxlQoVeDQoVes

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\da.pak.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	7616b0ee50d8e7c66787785d9666c4d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7616b0ee50d8e7c66787785d9666c4d0N.exe

C:\Users\Admin\AppData\Local\Temp\7616b0ee50d8e7c66787785d9666c4d0N.exe
"C:\Users\Admin\AppData\Local\Temp\7616b0ee50d8e7c66787785d9666c4d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
44KB

MD5
d3ce1c52370105e948c0e014aedb4fef

SHA1
5b6ec301d2e7a0f51ee2a16951d13654b3861dad

SHA256
c224add8502a4549c37245e6d152934eb9c850eb32f828e2e85a71c968201d6f

SHA512
642e2894c667bfe7671833fa8b5b71be8b23500ec12451e30421959c8a898a1276c64f4d544c252d9fc0f8f3c36a447df7357008a8b426e345ff2f2f460b1d12

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
71d1039b17f77a957e0408f3b280d59e

SHA1
d1b2028803a680b5919e7f6db7c6aea64818f5b0

SHA256
0c38a14db221034d5b7f5e9a4cb77bb3e06bf8560e861c1b48edaae2786855a0

SHA512
15331240c01d648d5b669c3db11eba775554cc5edad4fc185930816e820cbffd406aba02efc65e49e7b7954fc1ce0aa4475adb960801cfd3ec9b4f9b3a6a5c04

Download Submit
memory/3972-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3972-854-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download