00cff2ef0d0599e9de575e337f479544861e4d3b3482bbbe0cd024d7797e9d29

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa382462d2f37d78b33f51480e468640N.exe
Size

52KB
MD5

aa382462d2f37d78b33f51480e468640
SHA1

721612b876860314bbcfdb7fcfbec33ebd2cfae0
SHA256

00cff2ef0d0599e9de575e337f479544861e4d3b3482bbbe0cd024d7797e9d29
SHA512

496b00fda46fd7c3317c47edd05adfdea0ac0272b7932bb0a263546b07f8e34b6b56d686419b3d2a55b02e273342c3668ed706b2510f83d3c0f6cdbafc8177db
SSDEEP

1536:W7ZppApBULcfpHLcfpyD9uH9uH28m+h2h5:6pWpBwchcwD9uduW8mF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4551) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\am.pak.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	aa382462d2f37d78b33f51480e468640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	aa382462d2f37d78b33f51480e468640N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa382462d2f37d78b33f51480e468640N.exe

C:\Users\Admin\AppData\Local\Temp\aa382462d2f37d78b33f51480e468640N.exe
"C:\Users\Admin\AppData\Local\Temp\aa382462d2f37d78b33f51480e468640N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
53KB

MD5
193b1def173e96600b42c11f0456d7ed

SHA1
25d780729c7569ee0fb4de62b75ed0729ca39147

SHA256
183cda07ec9739f8a60336268d4b58e5e19aa1b1240c3e51d90eb139f2a4b912

SHA512
fca6a1545a04102a93a8ca0cbe8fe380e1f98173897e0e4d09f0e8af77d407c96040cb2b72f192482cfe390b9780e4ddf1480a260ed43d2efe6ae83cbbeef025

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
fddb2caa166f0be6b728c3fc0fe6f513

SHA1
fbe4e3848854ff0e68edb7771ade8a58d16ca6c4

SHA256
13ef050dd82133717e20cf59e84cba61083e9a212c87888b8ae5ccc1300375da

SHA512
5cb890a700b6154b157a60c690a5b1b6b6b8e376a9db17d022a02f7ffb39d52e0e8be56e5d4dcd9edf39e8e4869008fb5f8867d3e0e1a742a8b4214328f65373

Download Submit