161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
Size

90KB
MD5

86c996f01ff6e7e164026a86532164c4
SHA1

f4ec2f64d4fb08e900a809aceb844575f9710773
SHA256

161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6
SHA512

22bf7ad1650fa746e12a3927e70f19d1f2f177a7d016bc52c288fd2809578a5bd4b6f1ebb4b6a3f916c9fb239d8367c838d98df48ca10f024eb50469b24d21b0
SSDEEP

1536:W7Z+pApfGQ3y3RWvfmRfm9sKsSd53tjWC4Z24:6+WpDfmRfmhHtj94ZF

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4859) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe

C:\Users\Admin\AppData\Local\Temp\161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe
"C:\Users\Admin\AppData\Local\Temp\161179a4946d9c006e8adc032757470b4981ef98d7cc7d7cb150fb03448d62c6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
90KB

MD5
e2e61fcef4f1bd34823225f91c44718d

SHA1
75a2a0f1834c7236a55892fc961cc8469f047949

SHA256
7985fd07a1d3af05ecea8355497e27007db59060f66bc3165746264d1d29b0c3

SHA512
8371f03ea2adfaf6a8b95d9dc770eff2e4ee19d5cdcb8e3be0c60ea83c79dc6a9d43a37b50684e9531875cd080a285f5d697979d5358a97629acb15a82ba783f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
d1857233827bfbf71e1d4594fa2b4dc3

SHA1
5ab83f41afec889a52c595c636ec2d7e03f02c89

SHA256
43f73279baf3dac5ac3408f8489504e040bbb972fd5a27c865d44f2649e2fcf1

SHA512
294c23355805376d3af9ebadb483088b132bb2f64533c70fbd84f4b1a41227e1d2c639eb2c0e218844f9238253ea02111757082bca4f6af480641ed32f0c92f9

Download Submit