130c28846b5b4e1e479c19ea0023bbea63ae0120a8bb61d4d17672d77fb6f651

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a507868956b56ff0ef244c37708c7d50N.exe
Size

37KB
MD5

a507868956b56ff0ef244c37708c7d50
SHA1

2fb8f62b7cd96b557c8c3a46e8d36eb53eed0da1
SHA256

130c28846b5b4e1e479c19ea0023bbea63ae0120a8bb61d4d17672d77fb6f651
SHA512

88a5b7f79ded34edea014f9a6f1d746271448605a73cf86aba788a804ccb962e62c47c25e1c700eb851366f192eafacc613bb576c4af7a1801e21a941f7d3bdd
SSDEEP

192:tACUADIY0Br5xjL/nznlAgAQmP1oynLb22vtI0zWXPX3Hz2Hz3HOaO5:GBt7Br5xjL7lAgA71Fbhvt3WX5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	a507868956b56ff0ef244c37708c7d50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a507868956b56ff0ef244c37708c7d50N.exe

C:\Users\Admin\AppData\Local\Temp\a507868956b56ff0ef244c37708c7d50N.exe
"C:\Users\Admin\AppData\Local\Temp\a507868956b56ff0ef244c37708c7d50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
37KB

MD5
e50a2e3e1d60df49a852ac6d96c5caf0

SHA1
7d8a34fd8110e484f94da8e833db39698c054362

SHA256
c5a0bf46d0ff123d7b1ffd221fac54e03f490c5ef6ddf8e1e612c188e41d4fe6

SHA512
b98ecbccaecc36b933d6abe74d72fdcd761bb3cab541222f0b61a77e0da8e2a2cc856d98b1b82f3e6ed66be99b87d312d03264164bf90d1411d022d16ba0b4bb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
422c4d3d34d0f960d13784dbe78e03e1

SHA1
aec47a0bcef19f9dc1f4ad85b9ea0fd1936b0788

SHA256
6596192567503d6225446532f8c1b05e8ed44652cd21d3d2398bcb1125e201d8

SHA512
fd6301193371ecdcfea84026dec3fb643b5cd77ab8692cb37fe9bdaf53c0117b84ee79765937909b9ec53276d4a3fa9edfc1fdaaaf58783b3cd1700f29753d05

Download Submit