a7b1aa4a5c8ed7dcf85af88b05cc304057c83fbec28a2ecaba1dbae1a1583b99

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
Size

60KB
MD5

6aa23cba7b3f389cc1d6e0b95f01fde0
SHA1

0a78a7e86fe1766691b1004f76bed4db87d19966
SHA256

a7b1aa4a5c8ed7dcf85af88b05cc304057c83fbec28a2ecaba1dbae1a1583b99
SHA512

385319363e883826670d9e304bc2e310bd4aa71d58ec498ca4f8c5edad6874b6b52a2a53b565bdde43208974113aaeecd41d2de189fe6b7a0d0e99a013d5c1e5
SSDEEP

768:W7Blp+pARFbhBgnKL+8t8NZgo2in9u9rMBBB4F/MF/rWU:W7Z+pAp2nKLc2in9u9rMBBB62TWU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4510) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aa23cba7b3f389cc1d6e0b95f01fde0N.exe

C:\Users\Admin\AppData\Local\Temp\6aa23cba7b3f389cc1d6e0b95f01fde0N.exe
"C:\Users\Admin\AppData\Local\Temp\6aa23cba7b3f389cc1d6e0b95f01fde0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
61KB

MD5
ef211d42b19c047cb13c9aa35cf03c86

SHA1
21f7038d24f372258e2dfd364d611404159f822a

SHA256
0ed0dd552a1e31afb86593e4e1778fbcc380f995231f9d7f61fb7aa36305b4f8

SHA512
3db1405874f30785c06dd9ea23e98cdfabb3d88796a58de5617bbc45229f7947f91ddf7acc5819558aacde3fa56e13caf1af46da62739338b335e55c365e62a6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
f26fb38451d13c5619b41ad25a2f0ac0

SHA1
c39eee7e1d7da636a7627d0c15e2139526aeecda

SHA256
725f10425adfc0bbb2d72e8ddfaa0f91ea40d216e7cc06ca23fa0d99d2deff91

SHA512
8a93577bf3f1cacbf35208768a83a93ac1be875905ac977903f31acb03030d209e21160f5ae9476a59e26c5e4fd8340b02011e4279c517ee8c4dad1cb652b4be

Download Submit