c6c5e016dc6e7a2da2632ed55fafac6e2b23e2a5a24f2d7d5912f273f0c901cc

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77743c73980c15d1229a8ad3914f70d0N.exe
Size

50KB
MD5

77743c73980c15d1229a8ad3914f70d0
SHA1

a41292ef8455b3a44a9926a60d9ec0129ef63a77
SHA256

c6c5e016dc6e7a2da2632ed55fafac6e2b23e2a5a24f2d7d5912f273f0c901cc
SHA512

7e69804b8d4cb2ed0a44ba175914ba84cdda6cfa4ce172b5017d3c3a40aaa84b8c2bef2db9ec18339327b8aa3ca0af22ab3b249ca4d483eecb2a9bae60903b00
SSDEEP

1536:W7ZppApBULcfpHLcfpyDoAQeLeAeLeJ0z:6pWpBwchcwDO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\InstallDisable.vssm.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	77743c73980c15d1229a8ad3914f70d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	77743c73980c15d1229a8ad3914f70d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77743c73980c15d1229a8ad3914f70d0N.exe

C:\Users\Admin\AppData\Local\Temp\77743c73980c15d1229a8ad3914f70d0N.exe
"C:\Users\Admin\AppData\Local\Temp\77743c73980c15d1229a8ad3914f70d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
50KB

MD5
b1e86bc269add8ae59ecba4b33ee4125

SHA1
7c3154fbde1dfe94e95d3637946f5a9bbb346b20

SHA256
26a41037a00ec8ad04994538f5b4b32c62b37e2ee4eb384b5f948017597931c6

SHA512
659414550449097a1417a30301db57a21f10be76c7926c3cd9368021fad83ac44fe025ada99a25d37b44f4356e2d583e112dcac202be30f5ffc5d20a1883730b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
08d4655dbc07896857e36610f9dae97d

SHA1
82f9faec49bea3c91646ba24df0657c6b9b02351

SHA256
c2bda699335f805f7d27632fba6a6ee4d16f296b51069eb26b64d37d8cad9ece

SHA512
6420100c0ca538cfb624c1fd33a9aefe41a968ed82f482c03aebf741020668cc07a4329dfee838ee26f2fe36c747771b9ab79a179b25b56750058b1481853bee

Download Submit