919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2a

Analysis

max time kernel
119s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
Size

42KB
MD5

5c739f4da0ff5d277e4ffa2fe1b50a50
SHA1

e599c439bba30913367fb00a9aa1a223bd8204fd
SHA256

919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2a
SHA512

00b12d95cd7855c7d42dfbdd6144fecb448b02c3f135b2024d6573fd20b6d083a5f2223973874dcfe0ec2e6da65a34b59d4c6965dd6e6a801759ef10573cc417
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSR6R16Rd:W7ZhA7pApM21LOA1LOl6vSoq7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4652) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe

C:\Users\Admin\AppData\Local\Temp\919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe
"C:\Users\Admin\AppData\Local\Temp\919eb291735ba77baf2126c674047e4721e241d2a615156c469a266d699fed2aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3676,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
42KB

MD5
538928d574fed60161f6c9e1bdbf7018

SHA1
d3619e698f5bb799a46de8046fe518b022084ed3

SHA256
0b4d25edf444bf0d5b936ce59dce8e6dcdb178ed8cfbc0316eeb7ff9641acd60

SHA512
9119ae03e76a33c012a1c4cba603590a18479742da74c4e9714d9bb4bfda5af81b33427ebe0108b31113e66bdf7680017c36861027224ab88aac58e033369037

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
155KB

MD5
975b2bb3d4379dd91c701c0d8070b81e

SHA1
f5172c8bf92e14eccf508f94df516b1d0b8d5010

SHA256
72426d58c6a00d6cd7eca0b5d52d0e67990ba5b4ee1a36ed25da8c5ea22fd380

SHA512
37c39778f672cc093e34de865fa735806221719f4dd73281dd61dc2921d981b9fa8f2ef53d57465781d2ba9d54745a381cbe697509b642bb4dba66fd35188fc3

Download Submit