a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
Size

77KB
MD5

373b9561595ee4c002919cbb473bec67
SHA1

0c9fa787657e3327b0fd6dd094aac159c6bfb683
SHA256

a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def
SHA512

73269f7deeea67e1223f7cbf1ef8a23841a16cf21d61971616e34c550bf8df74570dc31a29e28a2a6ed148d4a1c5a4b59cc8191b72b30fd8129d4a6928b742bf
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZv1RMmdG3mdGl:6NLWpCZIzjwHwW

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-LIGHT.TTF.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe

C:\Users\Admin\AppData\Local\Temp\a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe
"C:\Users\Admin\AppData\Local\Temp\a44ae3ac7e3307c2e73dc7f2d85aed461dfa12fb9337dbb6596fd9ab78837def.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
77KB

MD5
c5473b4f3ea2b8cc1d32083b7bab144b

SHA1
6e7e10ab30c6acbbe31458f1178fbd4a982ef2ee

SHA256
2ccc310195236296014ffccdbded52572e0ebdeb5dee6a214065ea363edfdb02

SHA512
f9fbd9dbd2d0161bd37fc4448c4cc6f849228084e16a45a5060c9d17b50c70330adad911fb1c2b8b566b1005098747cfb3b52e8db035ccf94a0d93e0c17e066a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
637f99ab56075354b12b0ea9a1a3a936

SHA1
6c8b127faac4b91421a89aff137bd9cc9c1e73b8

SHA256
e2c68b08d843cb3898d43362d1bc18eaa6330106490e44d47b4e8d1c54fdc985

SHA512
5625eaf9456ff7e9595377c320452ed60c6a5eed8fd9a513efb0059e66ac44c12cc0277117f20e7a2c16087228eb96d5a4d305dd0d02aa34f44fd41fe5b21194

Download Submit