2eaa3d653c3e7ff3f045abad56088ffde45d5ea7241e33b34662e5bca6c2e004

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
Size

53KB
MD5

1ab67ef0aa79aa71ba91e12a4dcc8630
SHA1

68844f78d11fc651699d651f832d369149b1fdf8
SHA256

2eaa3d653c3e7ff3f045abad56088ffde45d5ea7241e33b34662e5bca6c2e004
SHA512

657222793c942fd9eb933b856123b4b386d442ed2eedc32cdc25229864d60d5cd18ba4b55380b131094e864817c2bcd633823b2013749818a9151c7c6705846d
SSDEEP

1536:W7Z2sspAp5YSfffdOP+UDpOP+UDunAQanAQf:62ssWpYXYX3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4629) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ab67ef0aa79aa71ba91e12a4dcc8630N.exe

C:\Users\Admin\AppData\Local\Temp\1ab67ef0aa79aa71ba91e12a4dcc8630N.exe
"C:\Users\Admin\AppData\Local\Temp\1ab67ef0aa79aa71ba91e12a4dcc8630N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
53KB

MD5
16291b0e2e02486cb52a3eb20bf2d3dc

SHA1
397ad5ccf23efb026ee404c5d22c48efe64cc3fa

SHA256
1a8e192b0ec5eae716cd7e4e1a4eb7a11ba8ae77a820207045ada92672e3466a

SHA512
1dbe2aa602a8224a77f4634cd90a7ed8bc8168ef237eb19229b795c3b4ab64c23b76e939ef8da1ba99ccdc8d719af4558d3516c8b0035fc5051a69a178fcf440

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
9dd4f1f2ad576545fea5ecfe5be74a9c

SHA1
c263f9e238d9d4ccaf5419c18ea726f8ba2b0022

SHA256
6a9f8a4cee9eb8322644e8e3641da99ec56d943c18a0e8364a465182bd3615fa

SHA512
1c76955292eeb457bc2017ee0593bdbd033faa6b3a467185d8129e13ced02395ee8b6ae25afccff80e8f8d6fc05cc6c9dbaa2f7b63c36aa5d5f186b272976515

Download Submit