07e99587ee458f5dfdd7ffb76dac3c955d4ad8b2b032b3a94b2565513454418b

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f52eb4100642c2365997dc1cc24b700N.exe
Size

46KB
MD5

7f52eb4100642c2365997dc1cc24b700
SHA1

f35a2201950538daf8bed22cb1c54c8d66da8027
SHA256

07e99587ee458f5dfdd7ffb76dac3c955d4ad8b2b032b3a94b2565513454418b
SHA512

60e74ab78e4524c07588e66bfc194383c883136c465937dd8278069bee265f4c3b8f035630cec8ac80e9e06b8d5149e599ac3e105bc2475dc8808c52f2470bca
SSDEEP

768:W7Blp2sspARFbhVgNNHpQRNHpQRiC76QC76N:W7Z2sspApctpQRtpQRi26Q26N

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4353) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	7f52eb4100642c2365997dc1cc24b700N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	7f52eb4100642c2365997dc1cc24b700N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f52eb4100642c2365997dc1cc24b700N.exe

C:\Users\Admin\AppData\Local\Temp\7f52eb4100642c2365997dc1cc24b700N.exe
"C:\Users\Admin\AppData\Local\Temp\7f52eb4100642c2365997dc1cc24b700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
47KB

MD5
d5fa8066552ebaf2309a3602281af670

SHA1
c8845b4952759da3596241de0effd0127245459c

SHA256
200f8896914a12053691c41f21d7871bc107cfdb615841f3a23c961c9a73efcd

SHA512
c69397d7ef4ad0c20cd76e3e33e4821527c145164353d0419ce9eb29f9a157dd24cea3b9fa897200a1a6c8e265456223c5119174779b286c3eabe2fc075f40ca

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
e2bbc064190b13cee6fbf6ac595fd35b

SHA1
ea98e502ca1e93083e9a9d7fed121b7138872a7a

SHA256
062f9b11d294d1a68ff4712fa4ca447c0aedf93afc5cd991212336dba00e06a4

SHA512
59c4d18039aecb4b5ee4909a3b0566a7581c21bd80cb937241552436563adfe20a3a235e6a944d5be01df1f95ec453bea58435b1f1369506f37a7c2f122649fb

Download Submit