755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8e

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
Size

75KB
MD5

e70cf19e53c2063103612497427f39b0
SHA1

f690a26f470e7c83edd3f130fa6653582b949c6d
SHA256

755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8e
SHA512

9577331b755ccbc73ca3733c9e07027b3c0d3775a3819421c658616874500c89ff3e6ecc0504b3ccce439171b2576deef5375d243af66d546d0e864e7b8ad0be
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8+CtlYSDAQ9:6e76mQSostXDAQ9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4645) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\LockCompare.xsl.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe

C:\Users\Admin\AppData\Local\Temp\755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
"C:\Users\Admin\AppData\Local\Temp\755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
75KB

MD5
2eda1fb7ee26adbca58836648e2b86c3

SHA1
47c13da663ae3dafb48145638d8d9cebf7fbc092

SHA256
963b0cf7f40f62ac388298d8288171c98c9f768ac48f8992127b51d93e909654

SHA512
ba9b92603e857faf7485858ab71a8e86af16821e5240092e8b772512381128547b9c91031b0f5677606530a221417902bddb6ad71ab8e4b4bfcec7dcbc8cc79a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
08678d20bbd30d9601e7a1295fcd23e0

SHA1
77cd5a5e17bc70d6731b5de1acd6c39caf8d85d4

SHA256
819f875461f12137a5f973705dbf47598c61be2adab6941f14d8438886c32d56

SHA512
48a1177f26814a2f6ea738d28da490ff0fb06785839824d3035348a72c14b9daef023c6be6f3b5ddc9178de28da767be0f7e480d7364ef28dbcf76c74dc9de83

Download Submit