60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
Size

144KB
MD5

355835d09511d1732eaf2db9647907af
SHA1

2b8078b6c52f2124b2dd7167fd1e5f6e1ddc1437
SHA256

60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd
SHA512

ec9c72a6e3ed8bf9c89debf4872c43a21cb56e46b8ce7cd46f66665e41f41c46b7924f0300c8401b751950ef8eb1e8e9299741993a0d1c7d4dfad1d68d2536c3
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7f/e7WpMaxeb0CYS:RqKvb0CYJ973e+eKZOf7fWqKvb0CYS

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4791) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\ConfirmShow.png.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe

C:\Users\Admin\AppData\Local\Temp\60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe
"C:\Users\Admin\AppData\Local\Temp\60e626a6978f01ac8725d5f0dda08c55967a89c14f9e5b53ffa09c32db1461bd.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
145KB

MD5
cc21861e794897c2a2e87c89352d6abe

SHA1
55db2df8fc943472ab79b74a5a0e6f14abf79bbc

SHA256
e9b60a77ecc6dd1f8d80e7b1185ef577caa5594af676ecfdb79af1f0851485af

SHA512
e5c7aa4cf84d49532067535e0e8ca46aab9c951c8c40a30d5fb19731ca33fb4b3aaaf9ad4ab5b8e86afc1818f1a1a2a6d56b20761689549cc2dd822702bb416e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
243KB

MD5
f399e98c2b483b910d9ea0bfb4adb0ed

SHA1
5259728a8ac553e0c634cea3221de44fb695b9fd

SHA256
8a98096c40c9fc72dcd9f583f6bb0435e8b4e717cd62ff6b99c90683d9ceb252

SHA512
d4d7235c4c3f5089c32ad3d97c13ead72f44501972e5312029929d457555bf9c763ade88a155c92aeda9182bc8d74af06cc5525689b8de1b4c456c6ee4e173b2

Download Submit