e39c603fa1291d77c76ceda44ef1ce12db76d51bd9ef927fc780797d7dfc43bf

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73f6da396f58e409024d5cb1e555a4c0N.exe
Size

120KB
MD5

73f6da396f58e409024d5cb1e555a4c0
SHA1

e85b8600d1ec60336837d3df1a4a134c2b2f15a0
SHA256

e39c603fa1291d77c76ceda44ef1ce12db76d51bd9ef927fc780797d7dfc43bf
SHA512

d82c1b50406aa2c6bd1ec192b9a725478d6b18deee85920c8a492120ff104126db1136c3af9fd7fd185305b0ca53242ebca02ed5da16cf491dbfe9f0dbcb73b3
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlfS:6e7WpRaSljZS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4359) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	73f6da396f58e409024d5cb1e555a4c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73f6da396f58e409024d5cb1e555a4c0N.exe

C:\Users\Admin\AppData\Local\Temp\73f6da396f58e409024d5cb1e555a4c0N.exe
"C:\Users\Admin\AppData\Local\Temp\73f6da396f58e409024d5cb1e555a4c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
120KB

MD5
f3987bfa6d2450c7ed81cae5533d1de4

SHA1
dd38373e5d25ddfd4878bdf1383eb537930b238d

SHA256
5833579c5a542f00cd5cc5c3f9d8d9a21cbbd627f4b523f077d2c7b0773fad2b

SHA512
c989239c6dfd12ab628c522daba6feb70e66c5aa15a2f835dbee53face108d1ea2b67d4ee986f5af055568a33c1a542e5e80c56e25ec9e1f24f9f2f414714b96

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
219KB

MD5
4b1a5ff3d245c155d2ba5a65ece9a81e

SHA1
226233e9e6cf6992ddaa96b48be81eb618b5fde3

SHA256
0e86768820f204892162588bc72c9a719b3e108885e600edcf9672ce4df70dcc

SHA512
b26b5c343b4f0d5c3d3588843ac8bdf8e35baba1087ecdbc93b06d32f76b880a59b23f1cca246cacdedec5fa638367c65b59a0d397f69a1f1ff5c0eac41a223c

Download Submit