5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
Size

56KB
MD5

530c9ce05a6b43114032bae2546d6532
SHA1

a3fa6e29a61da4a322b54f38f0ee803506b04a9c
SHA256

5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf
SHA512

f796e829ee09667ac2d3d9d6e9734ef0572283b598a299d300870bb521adc805f701d9c56d3d48fa5e316100e0b30f31a9fa7a638ca0baf1be07f9236bf31e87
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJl5H5IMs4MsI:W7ZppApyVyjVyv5H5a

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4823) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe

C:\Users\Admin\AppData\Local\Temp\5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe
"C:\Users\Admin\AppData\Local\Temp\5faba37531214c9720ffbc2692704a54008fe56a777094522637c7ebf0f06aaf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
57KB

MD5
166b9a18c7773c64afaf00b070f143a7

SHA1
451213d288ef6c2c444f0b4550ce15bb3ed52c0c

SHA256
40d0e4c1bc7f3f62836a4303642776623df175b9c633c7a5f77837c0989dce8d

SHA512
9499fb1b37724d2b6cb527314bea4766738609eb74c6815e1b81641ec8f1d154d40a03642126cc846d86889a30fc40649082e34cf8a4d0ac73c745a0df72b1c4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
8474f0484421d612d635484f94b7e7f2

SHA1
518bd7ea2dd4737b255e73e35a58c7b1cd2180fa

SHA256
b653ae67f00666d4356624987bdec537f0e84ae86808f0c0ade42132b4f96829

SHA512
b07408166f1b4dbfe1a913dc29a7e151f9913ccd206da0f14bdb78b8f42b499aeb73af9d010b9edcfd59071f28287e3fa2f235f8b81ec33b07bf05c35fe0e5a0

Download Submit