027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58e

Analysis

max time kernel
119s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
Size

70KB
MD5

a29e3bb91af685fb678e4d2dc5984070
SHA1

2012f0a7ea59f577df222218fd60fe5bf040bb40
SHA256

027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58e
SHA512

d436d166b5bc73043f2999e118d28ecf8f45712283e0276f6d63acc9465d2b82ca0351e42e834ebf12386d49fc9327a0e14e118306da7d2de4ddefe40e71c61a
SSDEEP

1536:W7ZNLpApCZuvIYXxJ75sNpJJ75sNpyPIXxXXS+Sy4SKmEQKmE2:6NLWpCZLYFXxXXS+SmKmTKmn

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4656) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe

C:\Users\Admin\AppData\Local\Temp\027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe
"C:\Users\Admin\AppData\Local\Temp\027f67a4654a106e62ccfa3206d3136a5e04e6172b2cc96ee406cee1e8a1b58eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
70KB

MD5
9e6be967dca74af1d753087745b31c52

SHA1
b156ee01dcd78c89061ff937eb7da13f28d54c58

SHA256
4796bb9fe92d87b4d8339bf8322c8d1eee03c1a79d3e1f356d895bb2d901e37b

SHA512
fadfcecfdd9e27e50cda16a305976189234171fa90809bee9d289a6cc6ad75cdccf833fbee9709237d19498f445e7b9300eb553369395b191bfe0dce7e1c73af

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
31c0b90e2838bfdbb84ab52f4de13318

SHA1
f106f81befa8ded4115f845ee27a628e4f83d22a

SHA256
65cc650617eb3affcc119bc43ee875cb43a11be0ca4e80aa6c974a0e7390ea33

SHA512
89ed626d23285c40a3906a85377fab96f09d5162fde3a1051d09827cacb31bebabda2855ccc92e88f1e4318a26b3a63ec08fe9dafeea46c56e225c856c88c51f

Download Submit