972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
Size

87KB
MD5

6be3e7fcccda9604496f7e4b30af0420
SHA1

c0fc97e4289867c68a0c0480492db55ccd704fc3
SHA256

972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0
SHA512

860420ea9bc812dea6bcd4ae914f0544ee5ae7f902080a7114b90686ee5c8f137922aeffdb45fde236a077328e8c95d9268483c28c69956b06ddb72765be5ebd
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYgqe1:6e7WpMaxeb0CYJ97lEYNR73e+eGG1qe1

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe

C:\Users\Admin\AppData\Local\Temp\972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe
"C:\Users\Admin\AppData\Local\Temp\972b8d121b9eb2569dee03cbf03f680803500e9ea686b84717c0a03e71602ab0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
88KB

MD5
ea3a8931ad48f4496480f777d45fbdfa

SHA1
2e36df55d56313db6e1f1a335eaf78fc265c91ba

SHA256
78918ff367f98315b36b7a424656ba83cfc6c956d8c588894c6220c03d12117c

SHA512
dccc3d54fa166d0c86e643bfc400cc2992dbda3054d39db3c572100d3a43d46fdaded9bb50891ea4cf6bd461feb4abd29477150bd6d430fbfceb93b644ea127f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
187KB

MD5
4270d4c6062922477d775c56d94d243d

SHA1
00d3edb77ad5295e5fcffd9bb5bfd15208f4b2a5

SHA256
3676837fe26bcdbcf7662bd7e1e78f894adf802b34390e54307cf9047d2f42dc

SHA512
4a739fa3963e6b8dbf38e0d6276bd55d309e5e87300a83beea1496b80a6c2ee4fb0deaa2214ed8721b0ff4b93edb71575b457a51920acaa3fc87e883f9a9d7ad

Download Submit