f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
Size

75KB
MD5

bb7a4df6bc928c493e1dba382c0a8325
SHA1

e3352ec325df8568ac34f5b6b949d5576b000a47
SHA256

f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824
SHA512

cb0de26caac1d5550e5f77056e3f6bf294705bfee3a99b4e4217ca2b263494c2f867dbfc057b1baa05d467127f952cc1e69b15c9647089648e928c4afc252268
SSDEEP

1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNkOP+UDpOP+UDt:62ssWpcU7lK1lKgknXYXR

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5034) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SFBAPPSDK.DLL.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe

C:\Users\Admin\AppData\Local\Temp\f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe
"C:\Users\Admin\AppData\Local\Temp\f770166b51391a8c4b6ffe3377c32f217c6ffd3d42f520d5f12cb1caf447f824.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
75KB

MD5
4fd02016995833f127958c5e55126378

SHA1
15db5b505553ebfa186fac7e3102aec17b3c26a6

SHA256
19c4a1447d3602668635bb934bb3d57bf9ee95340c7404fa70be403347c943bd

SHA512
4840314e7bee0d379271940c9ccc7b1e8c6cb80e74802b298246de62dcbb0b9906ee2c1723e32460e1b9948b40f57376809c38f9d84c1d2e062cca9989c8d829

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
e1d25deb1b100420ccdc575b5b1f7b8c

SHA1
6b2d7a218e9f862a6f1dcbb511f3cb111c8bc56e

SHA256
c6dc2c58ed29431ceb3d451cf5de573c9aceffe4560e8f3f1b87a74a8d301b1d

SHA512
8ea89a71b204e2516888e2effa8833550a5ab6d7af80f45242eb645a16fb5a8e0eb733d84de414feb74453e7286ea4feff0f28e7d00af1a1578788c86ddf0741

Download Submit