100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760a

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
Size

52KB
MD5

4a02dda55fda50278b350d135d80ad80
SHA1

2ce878acaf22625d2e0b07d390e868608b38c3c5
SHA256

100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760a
SHA512

bdee67485442a7420426f1556c837515ba6e5251b0c3d675d6b3612a71bdb28c78b577761bc576c6a0721b1778590bf9d380ea13f3c574d0fc2c8d4fff07ac54
SSDEEP

768:W7Blp2sspARFbhVgNNHpQRNHpQRxRYstRYsI+PeWwP9Pn:W7Z2sspApctpQRtpQRxRYstRYsbeWg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe

C:\Users\Admin\AppData\Local\Temp\100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe
"C:\Users\Admin\AppData\Local\Temp\100621a7b45de64adb41ac8b7a86659cc89b97b30e60ed91d03111f6cada760aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
52KB

MD5
d2d1abc68e54488160253f53609ade12

SHA1
d01a2df163332d29b5daba4830d9b9638428b968

SHA256
7683f193ec9560c731b4cbcffd69a1dab9de0c8ae4b31b749d02afaa06009484

SHA512
67295cfd76154b4fd37b351f37d63fdb0b95abc9c873fdeaf22073e89624f4495d54592fa3b2cb5d5dd3b9cab532e87702152eaf47f688a765d4055eb366f057

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
ba73e5feee5640f7a603e3808e51bd15

SHA1
6c04ee57a4b4dac23440e2b224c5f371c30f6076

SHA256
ed1e7b5ced15c47b52217b683d3b37ffe22d575742c523432907ea84f96c628a

SHA512
deb7609b54402b39a45cdfa2d0bbc506e56b034fa63e7f2c1d98b17dc1e7fb9d6f155ac68f9fda1dfd7099435419daeeb4c03c206b792c640726b5804957c346

Download Submit