0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
Size

81KB
MD5

eaa4ed82fe9bab560803269ea668bb8a
SHA1

eb6d8b2d9dc8ba5fd9ab5403862c0bc31b87bbf4
SHA256

0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58
SHA512

d7862504de7f087d1e2fa6ef6c990d10d3786ccac8e379458fad98779aaacc02e6ce3b10c320d33ba1e84b6e6015202856f2b9a43b54f607ef609dfa22f55ad5
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGc:6e76mQSohsUsUK0

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5033) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe

C:\Users\Admin\AppData\Local\Temp\0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe
"C:\Users\Admin\AppData\Local\Temp\0013a23978c30436f6175cc9810f4d7e5aa464e81638f359ee424b51fe488d58.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
82KB

MD5
cfa1db76ed2e5e6f678c99bb089bf9b6

SHA1
117048f7bd43c94cddf0871a214e8baf6c3019a3

SHA256
efd42e6c763583d8acf310e92a73e98b0f13d96d8d89a1d47c205af0572d090e

SHA512
af95e5c92c0db3c14e32ec47d5011213a4c38e4ab3d36d9dfe8ae79290816ebfc723bfffa3d18bfb632230ade849bd2c73cddf9ca5db561c31595ec5186dec5c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
8f1ebfd268eee340dfc83fb5374056e3

SHA1
ffc9c44101e059e3111a60c691dd18eb897ed394

SHA256
a0885e293141eba36375996f11ad24acaaceccf7caf40996ae54d3fed391422f

SHA512
a931f567389ac166c4189d3e9eaca14166115b05ac7c206500f9a14021f80d0dc1c0db30672f0584e2b70e76bbe34f0a34b518eb8bc1768e7a32ba2120a72a42

Download Submit