7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
Size

50KB
MD5

cb6f8067ede7a6b6b442c0aa6ab9346a
SHA1

fae618451dba628da4444dcc253fd5527ebbd8aa
SHA256

7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf
SHA512

fae52a7a50ab3ee98c5fe3d5b67e5244fcf5e7397587dfa6038bb23d1bf87b29e07025b2a72b557800a1101a75a13179dac2cffca9f3a9a6fb41387e33104d9c
SSDEEP

768:W7BlphA7pARFbhL801VvM801Vvv7PZaZP:W7ZhA7pApw03vR03vY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe

C:\Users\Admin\AppData\Local\Temp\7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe
"C:\Users\Admin\AppData\Local\Temp\7b19d6eb87c2c2a29f1e19e69c6fd4eb141b4822078fb03ec724db45e1279bbf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
50KB

MD5
1e7e9e50d332d643cda60b6b3134b230

SHA1
7294e08983eb494f594673fd9fae0c5b05901247

SHA256
45d4a5f80cb3fff84fff5119eb2f942a1cce40e6b73b83a40790bdf6e9bfc06f

SHA512
e541ed65cd5a1144c6372dc59305674a29f2a934d75ddb5b13d6a7a9386ae9a156a5e178b1ac6f109e78e06dae36c86be55eb94dad512bc6c6c05625e20bcd0c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
e8994ca6c9e040e2981143abf1275afa

SHA1
09b87edbe00d01d482dac0ebbad654d0aaf32df7

SHA256
b3c9c33076de0de017ae86b3a5e3291ba0c6d77788a1f71912db77096d15bf9c

SHA512
40769a7e2f2a3158a4277b29d57d5d533538762f8a4111c90ba93c57542186e9bbd87ba4f1c6272cffc876bd3ea67623a49974680abe3ce8b9b8aeed9a289514

Download Submit