7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726a

Analysis

max time kernel
119s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
Size

48KB
MD5

f68197e80e344be32160d4e38542f480
SHA1

cef11c3b0d0818b99fb832f42e6493331fca500a
SHA256

7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726a
SHA512

ca9fe143f25eeab54cdef5d564b1595ccbdb39456b01b0e9cd72a1381242128b8a6f21f469ee87dd46a2670d4032d59a9db37ae61142f77678d8ccc073676949
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1wbZUnUk:W7ZppApBULcfpHLcfpSo3f2W9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe

C:\Users\Admin\AppData\Local\Temp\7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe
"C:\Users\Admin\AppData\Local\Temp\7b4c57a1bee0322873ecd51d187cea95a2587fef12ea6f9b32ad44cb2ed8726aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
48KB

MD5
d04b6a2d959c2eeaced198bad157a200

SHA1
6294a2c324b7f419345566ecfd30726a7cf03c88

SHA256
2811625f734e98f71933a7712de66b97a51b551e95072c3bbb8d75150c1bde4f

SHA512
22b387d7b5045bf3af4e66fd91c03c4d8e5544d244adbcc4b7b8fa3ab7592186b21d900fe123ff6b529a22163075a8d690eaf12236219f2c2bb39ae42cdb76f6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
0cad330b45b4463d3685fd5d7f4734c1

SHA1
ef07d5d00547374eeca5abf59e0b500281000379

SHA256
d42c3037b42b406b59bbc39b357891cd80deba1608e0027cbb8dd0419f3d9cd1

SHA512
d6cd2d2c25e1f8145ca554f66c900cde44a44cc70a5d967d9050ca5c67b7403a09fc49b439012d12082650ad71c9b282af0a8097d9836ea6d418dd521fa3eda0

Download Submit