af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
Size

42KB
MD5

487fc93c549da802f06e1554f82cdbd0
SHA1

d7eb1c7e6ca13b674d9e15629366f45ca3af7221
SHA256

af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867
SHA512

24a3e96089388a530593405ea934ca36ed4b376e918e696d3036977b11642d4f9f23435a8d76eaab5a1529ee22aa6fc17adf4c8c2bd3f5105aed2a2bdc6d739c
SSDEEP

768:W7BlphA7dASbSjJJcbQbf1Oti1JGBQOOiQJhATNyQY9L:W7ZhA7dABJJZENTNyQY9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\BackupUnprotect.xls.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe

C:\Users\Admin\AppData\Local\Temp\af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe
"C:\Users\Admin\AppData\Local\Temp\af4a1d8e97d5b6dd560137528156566820793027239be6c359c85754063a8867N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
43KB

MD5
a17b66d2c1d995fd2db69be57f50b366

SHA1
b9ac9ceaa722521c182f80ebf72804b15c36a4bd

SHA256
ba2716a09a0411cbc44b14062fc2218da9458772dcb42b38a064b84cc76b2159

SHA512
2f2a1a8ae54d3251ac192cb68183643ad89c86c755b3ab9a6543d44dcd7a234e62f1e51ba4c9a5ad2da9309055bbc22c764d4f7fc609c9fb7487d3ad12d9794f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
da879031defd167474e408e203ba9464

SHA1
392dad9e2a30d25dd0343dea671b85f667a83380

SHA256
451fcf10f55422c120c1bf6f3548ad82e05473d7cc0eb40f53b05519a23768bf

SHA512
10465341abe5addd3e017a57cb3e893796dceeeaaa7ef1013338b3b291112a5239df4d54bfe68cd12be4471ea905268caa8ddc1a8fd368b77911aa7d458bb503

Download Submit