71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
Size

102KB
MD5

a3119c4d7a00d627ef15f71346803610
SHA1

9505caef0f75591f87f22e1f33e0e7caadaa0626
SHA256

71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90
SHA512

40ed5eb01c2e9e60b1d9cb465a646890f4fed0cc54ac07ee812f2e8099a4c1e0f4f1ead9707f1fe8df53d93674467f8a058124d725f63434ddc84b848c30c2b6
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFpsJOfFpsJ6X9:RqKvb0CYJ973e+eKZ/

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4363) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe

C:\Users\Admin\AppData\Local\Temp\71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe
"C:\Users\Admin\AppData\Local\Temp\71b4e873015eb260c01f33c7ff458632d2a972036219ccbac756521939078e90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
102KB

MD5
3227cc6ca9a4e28410e9cfe2dd4b4744

SHA1
0f9b47ba2a8ff722832f7aa5c14696806fb71486

SHA256
d5a285b91780ea2a4e11845fd80a1c15c84bf30b68f1eee10d180d0e182543cb

SHA512
78efdae3395eff3c5e6c2f9380902f695ac1d70f8107bf97ccfab162e6081ae70f86729e526310325c2bc6773c6e4ffc14ff8a41c05940739d053c1adc390c46

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
201KB

MD5
4f3c9c0f533ffe2b82d3ffb75592c10c

SHA1
faf87f99ee815467bed010d1fbfa28b9b23a9098

SHA256
14af40022c164066d9f70a08510886419ee725d3c8f2882cc902a6b422f47794

SHA512
426579d86e7d28dfaff66170a24051efe6cf9c27ab36843efc2bf9e1289b3ac52119836270fbfc31ce1ccb72fe81854833cf990ab3c22366dba81b54133b221e

Download Submit