5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
Size

89KB
MD5

9cf35d637f5e1da1e61082676adbb390
SHA1

6965f6c794ceeea75c445384d3abcfb8b9dc6bcd
SHA256

5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062
SHA512

b0e4eec6ac348b78930d5d195e4ac389a67751c2d1a1b32fd81ed8548405b1f79748a72ece9764f1400636c11c0da1b41a6f416c5a48554046b6d569d93d6b28
SSDEEP

1536:W7ZhA7pApH9QHwtRF9ESWu0SWujodsodaNovTW+SPL+cycWAF689ilL:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9C

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe

C:\Users\Admin\AppData\Local\Temp\5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe
"C:\Users\Admin\AppData\Local\Temp\5016f4c57a34fb9264e92e226b54d992769a7375abe7db767194741d65a4f062N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4360,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:8
1⤵
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
90KB

MD5
357e97eb9ae243cd9b96bc0bdc26a2d6

SHA1
b861c8f3fe771636df2cb3a071f4f1a603b96377

SHA256
0c07b7a38babdde449573c564bab083bab9118363b43f41ba1afa80bb652153d

SHA512
5e9e6d455d7b202f2237b6a49982af4852e2b9242723e022c9181be137db6960fcd61443b22ee0fb765bdcf030080a41238bd1f101c0eabdd8721d01da35843b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
202KB

MD5
4ac81e796abcff9908d2d80fb64ae6cd

SHA1
66994efdee41b551a95a32900b06d1b6194a73e7

SHA256
40b640e640c132b43c1f904bdb314dee9d1c7c22bc13fe39dd27c305656d3fc6

SHA512
19f2fab44a2eef384d5a74b0f6b7a0ac9927a473fc7d8622c3aeb96482dc0be13a1563f1cbf5c1d89e5e894a8750462d6e7b5d0807cf9e9444497e0e1386f2cb

Download Submit