3a79c22de6144d9ecc4a5a48ed944b4ffd4b5214ecceac5edb6868fba0ef97c3

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a7d2101c8154f1dff617cb0a49aa8f0N.exe
Size

41KB
MD5

2a7d2101c8154f1dff617cb0a49aa8f0
SHA1

8f9247ebcad94bef07306c420dea1ad1b71525d0
SHA256

3a79c22de6144d9ecc4a5a48ed944b4ffd4b5214ecceac5edb6868fba0ef97c3
SHA512

69b174510f1969f8a90dd20e768274a871356e33ec6678b857fd364145087f7bed44414681dec821c8ba1651e3e7802efcc07bf2be1638adfd1d1ff5b4a1e39a
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v7b22vZ11F1pJ3P30k:GBt7Br5xjL9AgA71Fbhv7bhvZ11F1nPV

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	2a7d2101c8154f1dff617cb0a49aa8f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a7d2101c8154f1dff617cb0a49aa8f0N.exe

C:\Users\Admin\AppData\Local\Temp\2a7d2101c8154f1dff617cb0a49aa8f0N.exe
"C:\Users\Admin\AppData\Local\Temp\2a7d2101c8154f1dff617cb0a49aa8f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
41KB

MD5
e97c6eeb4ccd017cf657233ad49935f1

SHA1
af04253adfba17b2eabb0a865f062ec6b7cff2f1

SHA256
f646ffe60e6d625212fda11c1505e9aefe4f5751508093abda0634fbcc3b19d0

SHA512
9bf04c9757d5d98384eb64eddb9c6045926dd2b5b1b3d0d7763d08ff31a805887499d3dfd4e9f75d4134462894df1a9efb93d6356f6f3225506ca575f2036512

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
83c433ef8a6fc2d81faeba598b219db0

SHA1
1769ee85fcf5e7e6585f104573e0ed47bd55a74c

SHA256
8fee9473c0a742c6712340f57755f1fa0921ae9c851d1b9773dc2870643779b8

SHA512
5b50668c9b761e7d919c74cd5aafc03c961dc787ab760233d8ce1d5052c5b475d933849efe8c19387c00639d38b969a709b5992908c35e8d70e087fe750c4b77

Download Submit