75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897e

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
Size

85KB
MD5

3a931649b1eb6fad82014aa94efff390
SHA1

a7763220fbb634ad32349887af7ed6d978f1f836
SHA256

75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897e
SHA512

5372516b4a2ba07d01cfcd36233fb872a9b54ba6931e2f2622fb8596fc5f8921bf6b6848ddf5bc45c169cb1f7fab26bf606bc027246f608e4aa8bc62635f45cd
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKggBoFoP:69WpQE0zxgBmw

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe

C:\Users\Admin\AppData\Local\Temp\75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe
"C:\Users\Admin\AppData\Local\Temp\75bff44e98f2c6453c75ab9ffc091f9a2c01885b83d9a365f7fc576dc908897eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
86KB

MD5
a1b567c98496d1f79cd707f8d5a97031

SHA1
e0b0d309cecbbf8bef96f505f1f34730458fcae6

SHA256
ac1d8caa6a14cd6199677dba13664d74eae503e2f5c4e21f470aa30285fffa56

SHA512
ecd581e48a7a4113dc372c6eb42a6c56fff2ed5dd0218c7cbf4ae3d4f41dc72e4821ec4cb644ec1c3e17ae7bbb17d0d6735fca9496667c7cf5b11715018a0137

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
bfded4c71fe9b2e88ef02ca21b98cc6f

SHA1
b7d5899039899e47c1dbe40337bd0c77b4cf3896

SHA256
59a3d765b5ce3d9134f256738b886680c7dfdca433677c48f4448803588aa34f

SHA512
3aaa32c109125bd23aa107ce1f958b5e92a1fa48f7321061df36eed736b639a032b67e87f2e8824946d5ff92821575989c1923f7002bcbf69935c569af4b88b0

Download Submit