441f34d82b3ef1625f424bf035b2a05f787f3184ad07963caea14d3ce38429ec

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75efdfc0445a686023aa394ea8c66430N.exe
Size

71KB
MD5

75efdfc0445a686023aa394ea8c66430
SHA1

253594bb668a2e82fb9ee19c98f49a55dc543351
SHA256

441f34d82b3ef1625f424bf035b2a05f787f3184ad07963caea14d3ce38429ec
SHA512

00cf73b58a6a658d40427281c7e84aff4d7a3b5c8f498e620bc147ee7fa9a7eae2231f552f9ccb1011ac5a1ff104f96ce1dc4a1f99acf14e55401280afea236e
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/EUN6J2c:W7ZppApBULcfpHLcfpX2/Nw/NwmxBRn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	75efdfc0445a686023aa394ea8c66430N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75efdfc0445a686023aa394ea8c66430N.exe

C:\Users\Admin\AppData\Local\Temp\75efdfc0445a686023aa394ea8c66430N.exe
"C:\Users\Admin\AppData\Local\Temp\75efdfc0445a686023aa394ea8c66430N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
72KB

MD5
1309745213c85b25a6160332b3874487

SHA1
421be99847cf7674f400da02ff195deb14797571

SHA256
ead05708705dc2312df28ba91e298eb6f4567c02a393941c969ab02c01e675b1

SHA512
7ecf08327fe14cc776ca208b7754e669fc063c42eb830d31282574f036d74a0fa1e7bde314781db6964d53312626c396cf1d69c0ab7299227b48ce67a055cf5d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
9ec592d3539ab01a52ccc7b99294647b

SHA1
e596d6bceef4ee9f55a11e9d97bf8ab9e0b248d2

SHA256
e4c7e01adb02d068a44b8320357b503f449ff52d9eec116dc8692681445d483f

SHA512
13ad8a945a50c92bc469ffd45a418f8184300fab375e9f087f2aea067a8a30aa21294ec160d61b8c2047852efd16e289a2e4dd6fc916eaf54754e4914554964c

Download Submit