1ba0b4896a78b41ee226d7371738c1869d79a8e6d943b822de58776bbd907d96

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ac40ab55c259bbbdfe64f16765f2e0N.exe
Size

34KB
MD5

73ac40ab55c259bbbdfe64f16765f2e0
SHA1

611f57132e665754c9eca26f5d6f862e891ba3a7
SHA256

1ba0b4896a78b41ee226d7371738c1869d79a8e6d943b822de58776bbd907d96
SHA512

b19740b1b54f17a983c1a4422ad911becc7b16a295cd6e046a547337d044d862448d5e9d5bafe4817417406e8583efb658926d0cdb18d61a15cc57049ceb94f4
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lv:W7ZhA7pApM21LOA1LOl6O

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	73ac40ab55c259bbbdfe64f16765f2e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73ac40ab55c259bbbdfe64f16765f2e0N.exe

C:\Users\Admin\AppData\Local\Temp\73ac40ab55c259bbbdfe64f16765f2e0N.exe
"C:\Users\Admin\AppData\Local\Temp\73ac40ab55c259bbbdfe64f16765f2e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
34KB

MD5
f9cbb89c40bf58d9b4688657603f313f

SHA1
29396e466191aac080bcba08759775402131924c

SHA256
fb80cf7cf1f64efff9eaa91a5c706cb90b301561bf5ba7e8f321d585d1de3357

SHA512
dee4067a513cd9017b01f1418be8ea417b8045020ca7e13e99551ebc265232f94b9109d90d354f228a1b66d25d6366ba0aaf793d6564d6176da79f54365ec182

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
0e6f4fb07af137e919d4362c12aed5d4

SHA1
c31c5749f85645967500829a77948e6647a808cc

SHA256
38904e5c7eb9646b7bdab7e4a536ec5c4a63a777b057ccc7d544d1280f9a689e

SHA512
8eb2c3f0d6e57bf5d1d441e9b46691c297cbb02c6c912e7e74652bc220eb84770eada177b44fb1857fc62ea5c5cb5e83028ea684dd80e079af62d384b86836fe

Download Submit