5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
Size

80KB
MD5

6ad218846dc7262662fb2deec654da6a
SHA1

08889082442f51fb6eaa06535735c8c9d5af5ee7
SHA256

5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46
SHA512

b8a999df29077675dcd85611e1352003b7ce555704022721261f7d9db396a334b4bb441d459790a346474fd76d310a6e53ce63ff9dcccbb51043bedf2b7cd545
SSDEEP

768:/7BlpQpARFbhWGUKBb4JxobNlAGA+qAJwDqAJwD8l:/7ZQpAp+KBpbNiBF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5007) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe

C:\Users\Admin\AppData\Local\Temp\5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe
"C:\Users\Admin\AppData\Local\Temp\5b01b53eeadc8f385e6acb51af063bd4cb75d7824d7ddfb6498d2a32ab72ab46.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
80KB

MD5
a2fbc38c86a3beec041629144fb90ae4

SHA1
72f947929c493e60d1cd377c53f7cde3b445c77c

SHA256
2b2915da3eac3f3ed4aa8a87db89035df23915d3aaeecc01c76df530fe021411

SHA512
47ee2c74b427f536094fbfcdbb9df65db5d4469dd4bed815765e20f103e4dcb9cbe15054e0d68d8a834ebef1c2bb374f46fa4ac5dc46a2431ba251e2a5cacdc8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
a6c183793d19272c1a9a767d32ea3b12

SHA1
f22c48c5c332e60c1256aa5fc0d81a803ab92f57

SHA256
d156ef399dfa52fbac09b12a499084bf867fe02b10137bc7c1643d4778eac9ce

SHA512
0927b13d81023024c8fa9785801f3b5ce014f25238285c16e9856a0fa1b04d6473b1ce41de24d0b9c7f2daffc360ff81163569168a3643a6a78aeb957e129255

Download Submit
memory/1864-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-852-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download