91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
Size

50KB
MD5

2aeca2bcd7d4f8f548164fc6fd1008fc
SHA1

d1a2e30526930340a6ed227b41aae8cbf0fb6b48
SHA256

91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820
SHA512

bcd516c32468f715bbd81c27d76b6216c812cd1a4138d714c01a92d9ddb36f63bf690120462f74413a1a18b0cd5a38e71d2e24031ffa92003cc2e8016ffb71ff
SSDEEP

1536:W7ZppApBULcfpHLcfpyDUdyGdyjnKwjzhjzr:6pWpBwchcwDNZjVj3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe

C:\Users\Admin\AppData\Local\Temp\91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe
"C:\Users\Admin\AppData\Local\Temp\91ff5a9a2507ede4fc1bfda6bf228d659ff7dbd057ade71c5c3e5d3547116820.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
50KB

MD5
27edbc6bfe8cf5e5810b9b63c358c21a

SHA1
5f17cfbd125cf02d5756f56e206cdbb79250394e

SHA256
f147f624af595758e1713f6e8f83edad57a409cc3da644b67aea6b1157e5fedc

SHA512
ca7923bfb774262691f47bf52030965f74bcb652bd8c08c33c6d9ca42f05ca13dd4f5365f817256458d49427ad5f8b8c9decad8f563ae5c44fab43cde77bb8f6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
bb7bdb518e00ef1876fecd727e147656

SHA1
59e8c65642c625220201e2bd4f4a963ad7c9fce8

SHA256
4b0800aa4fa4b7c4da4880c70d6534eec3ef195c716cfbb2ac0b419a57af97f7

SHA512
d499898a627a86342ddc7f6f96c92441243ce8af3786a8931d291d75c26a398d6e7c48c63fd9af315d8ac64959c96dd307b1fe20471f2681adeee4726d0d3ba4

Download Submit