00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
Size

120KB
MD5

36784d4cd4cebed0c7d6111ef3e5bd89
SHA1

202fd73821af937c93880aad451670ee0f1b16ba
SHA256

00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee
SHA512

9d5a0b6abb1971a616dfcaf12cc404380378105ecc6e72200261a8861393bb7f812ab04fa75af6bc34da5cdfbed3c24b72d4682869363d9e5a1a7dec04abdfc5
SSDEEP

3072:6e76BtEkoIAkeF0RNyreZ8PRmqIZq9awE0ctUiQF2vUHFe+0AkyyDfEmU0RFWn:Re/EU2

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4868) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\ConvertPublish.vsx.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe

C:\Users\Admin\AppData\Local\Temp\00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe
"C:\Users\Admin\AppData\Local\Temp\00834e34f8f478be8b760a9d2bdb1cded018a2f6bb52f36f72c66794604af8ee.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
120KB

MD5
e6eefd542a53c985da9305d0be4285e2

SHA1
bc2bd087dc4cfa6100c392c82dcb0a6f9f156100

SHA256
7fbb6f82ba4ea48af9c48161620b9affcec7b9d466ca2bf58538eb928a61284a

SHA512
3bd2b248f2f50e721fc12041d78755fadd0c0b841b80d5b786d639f0d76168ad899e607149d8c764bd8668f2c037a821347d5011a9f8f223bdc61a0e9ce6443c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
219KB

MD5
8ef62a4e5cbfba0de223e6d1b44c908a

SHA1
666e66ee964853013ec6abff39d7587a25bb8d6a

SHA256
1fd5d6f209493777774ed0eb701dbc2ad13e7f8326f2f6b62e12eda5bf23acae

SHA512
1aa32d9530f91ddc07cd626f745033633f3e2646545562c029958a70cb82b4ccd955c6aa95952444906baa6e180e1866d17aa03e475091c575273cb8ef8407b5

Download Submit