a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
Size

51KB
MD5

c739f8037f841aecc475617810197419
SHA1

15c56f3d67e63d79319384b18a95ab2c2d91271c
SHA256

a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec
SHA512

801bf60c0a6480c91070e994597ab4ec7073132d88e722bbf588a06fbd250f2d0de2d1f613da5e44bbaba930fc27f82a2e5a1c97361e398abb305c8adddf6f81
SSDEEP

1536:W7ZppApBULcfpHLcfp/ZeLP2uyKoIWbsHfySkT5GeCyi348oWGRPOzkjId6q8Udw:6pWpBwchc5ZeJyKoIWbsHfySkT5GeCyL

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5183) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJHBD.TTC.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe

C:\Users\Admin\AppData\Local\Temp\a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe
"C:\Users\Admin\AppData\Local\Temp\a91fc71a04da4b71d9168fa832e760f6f355867f7f8c4f10d10306ec87d05fec.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
51KB

MD5
596b233b4f1fc58aa3e8567caa011904

SHA1
51eaada3abd4a7f66e7234f12a078efdbd848964

SHA256
24879e4fe66f1ca10c079aedd1f22bb6baa5811790094a72bb421c2fc210943d

SHA512
044fcc71fedeb88ec73fc8b201ddd05f2b4af2a9d6a8eab4cab8db0b1841b249bf9977af7d50e835f92a66e863b722e61ba6ea69ce4569ddcbe2475136294a78

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
2e4ba08b0ca7c83d57182e7560edbc50

SHA1
c9dd6f26e1d7b1b4f410010c52600c2965000ab1

SHA256
f708c7f83373055ca0b4b3a35ef938468d92f3345aa6bb9c7e85420547d92c02

SHA512
04ce81ef06f5a85f1109c4202f6cfb50fa0afd8ddd92b14a73e3742aa5d008ed22ea311967573fe17439c9d122e572273ef551be36eb7c37cd9699b7058a6e39

Download Submit