06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
Size

63KB
MD5

c13db6465d884e4c842a3efd45898f21
SHA1

aeade95c05124b6bbe618f0987f23bc215843335
SHA256

06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444
SHA512

e5cfb485de51e7c5ac23713cbc2af1fa1b1585fb6b99b04e8758e77a02c5bb9e3e6e11c7c6c193a88a212e800bedf79f71ff87e6486e546c178e401accd69b2a
SSDEEP

1536:W7ZrpApojswv0EhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsF9:6rWpcsHEhLfyBtPf50FWkFpPDze/qFs9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4876) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe

C:\Users\Admin\AppData\Local\Temp\06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe
"C:\Users\Admin\AppData\Local\Temp\06e5bfd7a192a97df52ef0e24cf51f5df01da4c1d1bb385c7f5f4638d953d444.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
63KB

MD5
75be03dc0491e55f23c8034455bcf5bd

SHA1
878249424fb82fb0ef98e10b4b60cc157c4fd651

SHA256
a2c526804dce93de0d7e57a082f3a0a58cd96c573db7962fc336cf4ecc101a53

SHA512
5d6fd6c4a8f3b866686b4e1387826acd359d498a7d780a534d1695569b9838d72247297808647224ce23e7912d3ea9a091116b612c9971f7a61323e2c09d2d47

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
176KB

MD5
e8c6e4547e6dcf43a0020c019011959f

SHA1
337e58dc17bfb782a8adf80917f2e3712b3198ea

SHA256
e34e7f0ba928c94dfea776a37186f4bc76b8fbab98d6de6743691b9ba1e97632

SHA512
9d045572d0d02363804ecf258947c239d0d850470dd7dd45d1d9932921526154922cbd4f5b952e27508675b8888d4320b68fe55334de1f631dbd9a2fc99b86dc

Download Submit