7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998c

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
Size

90KB
MD5

2d0fe0c27f523d19cc8c6cf3e7525a10
SHA1

46722211eb3b9d89ffea4c9720af059ae951f659
SHA256

7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998c
SHA512

927411f813a79828bac9759e2b16a53b395e8ea128adaab467ecf5b76daa5831a1ba82e959b9818ba97c1cd0e30e6c610cb50732c74b84854dd9931662662b48
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvapBpYYp:6NLWpCZIzjwHwk

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4303) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe

C:\Users\Admin\AppData\Local\Temp\7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe
"C:\Users\Admin\AppData\Local\Temp\7c730885926b8e9b9a52d28d4b1849c79072f265119182fc9b94c41fe96a998cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
90KB

MD5
714dd233d01f5aa084acaee717065762

SHA1
ab0e179ca78641b565b27b9784fd86a031877baa

SHA256
f3d1c1c69c64d9e4df4f5965d9eb903287499d75215156e921e085d89a35bc3d

SHA512
55e57e3df4c465d97bf0af344285af3f298d89c5d75311bc4a34e6770a7273a8bdf693ff7a75f2ebb94a3509e05ee562cf1a9c947e1f1f4345e72795ebec1631

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
76f06431afd82729963a78e4eef0a028

SHA1
021a1c1d247758a85d8cd45bbf77ff9c6f790a0f

SHA256
dee58346243fd4f29083d8e57c355d29b274fd96a8845ab3fa734ccf0a9da9b0

SHA512
774ef4e0030f0cd955868ad479e50013c29de10725dab25f8ffe94ea2e96bad486a42975f5f3bb1dae6a8bb1abc0739c3ec9761bf075db8eb9bacbd3e7233290

Download Submit