708b03aa99f83e986bdcff7760e3b94c0d27db88174ce94461923de38cc39f90

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa8859e521f0be5dd5eccf5570a4a240N.exe
Size

47KB
MD5

aa8859e521f0be5dd5eccf5570a4a240
SHA1

cd57f67e2637f45f148bf743f1ac917d217915c0
SHA256

708b03aa99f83e986bdcff7760e3b94c0d27db88174ce94461923de38cc39f90
SHA512

3d7ec6620fcb82c0efc4b8442ca8f1fda7e00b741df16f5cc81025a2ae4e6cba024727feeb6b793600672bf0af947113df24e0a18fc8dddd48dddcd5e0f0b5bd
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSwVEVXj:W7ZhA7pApM21LOA1LOl6vSVj

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	aa8859e521f0be5dd5eccf5570a4a240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa8859e521f0be5dd5eccf5570a4a240N.exe

C:\Users\Admin\AppData\Local\Temp\aa8859e521f0be5dd5eccf5570a4a240N.exe
"C:\Users\Admin\AppData\Local\Temp\aa8859e521f0be5dd5eccf5570a4a240N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
48KB

MD5
da2546be84f34c7521d3d2bfc503e204

SHA1
be0b7ee929c7f221f5b0a63c15a0846193b16658

SHA256
9bf5ffa77c57d7594f989184feeb582f379a530e080faafa11d145a7f8c47d32

SHA512
360860cce79bb6fbe1ec651d755048eda572bed11e6d2aab2fa9738d0743246333036fbbbaeff71bf95de4863d2bd66d626bd8eb88cd983dc9bb0e76212215ec

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
146KB

MD5
8be68ccdfc7a38105ab94b87c05ded50

SHA1
cc8bfaf981a516521af332892e7f8e6d4d5d2f4d

SHA256
c28081e341159c8c2cdba6ede3988bc5e119a0f58071926e620f8d060760ec6e

SHA512
909c3c7ce87824d80b3197d1ca43d90e963b32a36379dba48b7a9245cb7faf7a93b09b23860bc7be272ec8152c1e4e0cae3651a42ebe517e5f314965e3a3c466

Download Submit