6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
Size

99KB
MD5

5f9889983f881bb81e3a4935952b15dd
SHA1

c33bc07f2aa83e62af95326c3d9411f054ccdafd
SHA256

6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0
SHA512

a93ff9c2ef42c07e41b79d563ecfb050c08486f4d1f98d5fa39133feb35f31ea18cd10413673d35d20cfbb4e66d7752bb9528debdf7b428454bc3d3107251021
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB9:PqFF2Ie+efsL1UabUar

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4878) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX.tmp	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe

C:\Users\Admin\AppData\Local\Temp\6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe
"C:\Users\Admin\AppData\Local\Temp\6e0866acd8b6b8d2646c671b2e7728fd18e6689b07b1479aed35a3d5bea03fe0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
99KB

MD5
52701432435506b42801dd58091bb411

SHA1
04c7441227ff7be65334de712dcb839e08098e17

SHA256
076f3208742847d018a2b7c48dec23f166620181031ecfb6ab1130a2f537fc62

SHA512
6a1f89b820609ed2bdf23fb4260a6560180c1537e2c3b149568bf48b328905342c501c370b4bc73730be5611e5c4c668b2c0f8db09f8f20ebbbc89eb9a3a9f10

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
198KB

MD5
c74f7b688473c3deca4ca74e17334e73

SHA1
c69e2439fe044ab5bddff5f7795a2076240b283f

SHA256
8a07525e3eca73a22966cf35f17efdc3ef9f0bee279a35d6201dbb42dbacaedf

SHA512
d81de67c325a894276e2db92bdf661d9ef86363d577fe166f77cb8b44a8cea7fb29d1a0d976c7f998d393ed223498125a1a606db5a41301c1d5e23f88e96f4ba

Download Submit