487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
Size

77KB
MD5

081a7f68e03924414fcc342afa2c8366
SHA1

effddc4854d58a03ad31c1ad2f035befb50d2d18
SHA256

487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a
SHA512

d131db4e73152e48152d86a8344db26f2c6fa72aa0527fa241ead858c1bd7ebb62896da90f954f1c53c5e35246242031716a0bbc05ac3be06cc46719b2d5e59a
SSDEEP

768:W7BlphA7pARFbhvOsTKnKqtb4HBZjlwGpCYnigugqOzM9bdifwMtxEwJjlVk0:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe

C:\Users\Admin\AppData\Local\Temp\487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe
"C:\Users\Admin\AppData\Local\Temp\487b89d7af4e29ea8194ca07b3faba37112eab5470b57b4f47025a21a112b94a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
77KB

MD5
20212a5df785b5f8f893c7fc84649648

SHA1
219b574a9639e890cb7124614c9d087cef6f6459

SHA256
f072dfd0003f35b1a61b08cd46204b1d8aae30d9e0891207da4e51843cd5d703

SHA512
81df5a4a0de6f391f3640dbfb34cee9ab73301eda016f6e7a18e409d6e9693dadeeaf9d567c46c1e4c146bfb1f59ba45d6f2ccaa36084c911073b2a5a71d43ec

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
008b26d7222e73a19786133aa5065410

SHA1
6c1f57ee6c94a980ed584a4dec1f8ab468a3826e

SHA256
16af5827be652f6e53899ac9d88d202b88cb1182d59dd5370457767939ac3574

SHA512
3a36caabaf9179bc68e364a71474854558e24a0396dd477da1cebc75ee6deaef5e38764a0dc4acbc59b647c14c59d2b3c6438e6c8e4b67b083fc660b4b49cb1e

Download Submit