317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
Size

51KB
MD5

6c9e8cbcbd9f9302f597fe0cc10a05e8
SHA1

bfe52a05dd8af0c74fa412b0170adc3b917a852d
SHA256

317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84
SHA512

6fd3836af2c3988583f3ccd69325ca03e737d764a86ad3c691397417235593219f124056ea12e7f70f3fc7498984553d934482463726e40474c2c0f2c5055887
SSDEEP

768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzE1IwScIwSWF/MF/y:W7Z2sspAp5YSfffMrfr92a

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5110) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe

C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
51KB

MD5
20dfd0271589bf6fff3109975f407d42

SHA1
019cb29b3f0d17621a6c99227656d6e8f71b0af4

SHA256
49135fd66090f1e011e18eb1fc805c5d085492ed8dad8b14c8fa0ff6e6504c22

SHA512
6466660ac24fd68ef03f29659e22ce5266c7aa777e53fb808b0ae52f4d100c5d8ad1e4eb15693a9804f95c31b37f62392dc43f4d57cb6b502286ce14f00dfd55

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
92139a613aa4c3482253e2a8ee22ae4c

SHA1
b0c21eb1b7aa3bfb7d5e70de6b2b2a36f6d56ed3

SHA256
63e39bf9b451d0d19ad2723c34a4a7cd2a5f33ea30585a0b768954462555119c

SHA512
2a9defbbe2ffda547b29ffed458489e0246ce1ff4d190934c67dec362c07141d839f49453656ad35d4a1e07682b2de4e233a156dfc8189f0dbb11f3875ca607a

Download Submit