69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
Size

51KB
MD5

6f2ee0fea3e001f367d468268c696624
SHA1

f234a4cf1dd6046e414d3c005fa9a688a4ec71d8
SHA256

69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad
SHA512

255ee733b41da0e85c2691f93a0e11121921e273d1380b94a94697880b06f93e4670e6c1a63b8679cddb46421c3c82132a2b394206b8dc86a4438de244ac96d5
SSDEEP

768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyUA9TEswT2H6uZwT2H6uu:W7ZppApyVyjVyJ9T7wT2H6uZwT2H6uu

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\ConvertToSplit.xml.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.GIF.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-math-l1-1-0.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe

C:\Users\Admin\AppData\Local\Temp\69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe
"C:\Users\Admin\AppData\Local\Temp\69ace6a10ebddf60dce34348a6a4928ff8b40f07ea8c1d3e24031f4e8f600cad.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
51KB

MD5
6f1c26c11f17b62ffaa43043fe81d0a5

SHA1
00e4d4be7b26e67455052a3ae410a88e2ff3d2c9

SHA256
58fddcbeacd79357838d3309ecb049413e664f7f251c6fd72ab1e922c440447b

SHA512
91b769e5800181e683c4cb6a262d101800521480b98698257aae860cf9a906ad2bb54fa1d7db202c25fb5f4e04f23be9296df0cf02402ff0eae44984d9b8cc89

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
b7034e0ebcb31a678443b3a8b61cead9

SHA1
04a9abb8456f49e7cfdff49f70f138dbdc30c988

SHA256
f4c43df7fbef6c255c188b26146f83a67d5c0e02d1c017bf1ba527295f21e124

SHA512
948103c57b1dfd56d37e8ee055c46af2a946789b677d2f17a599a0a667cfc9d5f43c55d58cb37630e1b4995367a174a85e81654c7893e7ec7c4f424a8f86295d

Download Submit