773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
Size

87KB
MD5

7aff243559e540b58e5cc841767b3c00
SHA1

26a9026d0fec708780a121af2545f19e5e30ebb5
SHA256

773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128
SHA512

e1bfc628e698c048fdbdbc3f9705c7209bf2edc90ba4e0a1a92b4931cca99dcd63318f5d1d393cb563218c42cb3c10bc6699f37b43347ae34820c0f12f426bb3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYrc4:6e7WpMaxeb0CYJ97lEYNR73e+eGG8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4522) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe

C:\Users\Admin\AppData\Local\Temp\773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe
"C:\Users\Admin\AppData\Local\Temp\773908791b7090aa77e94217ddb010ab888bdacb32f1373e90d82175c584f128N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
87KB

MD5
c62c57fd9e749e498216aad9193f41b9

SHA1
b9333e53e108c1cd606a90046c20d26d782f2542

SHA256
e97d35b520371a77980e41bc15efdb014da04032c76a34688657335e3d6d663e

SHA512
6900c6d0627dd650e5b08ec6c8d4bfcb443b54f8190060357db66d5dcdfdaffc4166dde8825cab313a5f6297debf5479e80da84231958b7e310c22dc54446c4e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
cfe9c9acf33a6ca9d37ea1c3d96d7e99

SHA1
3be34104cf19ba86f74554d04d3c0055405a087a

SHA256
81b5051886829441b8aaf42d27d69e7e5799d599cf43b319a0e6b5e4f8166720

SHA512
6a54d2521f215cd840c8b253521d5463c89691d2f49566d0e918bb59d83e2a62131e7604f30fe6bf2257b155d4c403ac23d5d558f5e7d92fb89730db2bcd9826

Download Submit