1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2c

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
Size

76KB
MD5

a2c8f80ac551143d3df29a3a33ef90b0
SHA1

fc7fd6102b0b8d7ef1c069541fb3b75d0068ec61
SHA256

1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2c
SHA512

0b915d2c287cf519a865b0a0508763a0fc5c49163567536d7773dda2c0b5b2282d91bff4798bf6a75270fd9ab10c05cc01a16ac63a10c6bdf4ec0707c47d06fe
SSDEEP

1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8+CtlYSDP:6e76mQSostXDP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe

C:\Users\Admin\AppData\Local\Temp\1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe
"C:\Users\Admin\AppData\Local\Temp\1ab54aeba986ecdcc7d4fe57d5ab88fcf31a193e1775107d5bd717a83468fe2cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
76KB

MD5
9e49894c53d092018d7f0c3501d79ff8

SHA1
cb5d849772d4844061173948217a8e7b9f4ee06b

SHA256
10825e9a5727df9d56fcb6ded3aa8aa08dd98eb407a6757071096bb456eb3dc8

SHA512
df4e44f4c739a3f0a41a55cf0989e1b6e5d192afa398c910c05d00ca1c59fd3114204fb4d3dc1fc680c29ddf16b4ed1c536627786a2fc8313212e2570fca7a47

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
eb9ddbe54aebd6daebc17b743aacc2d8

SHA1
e3144ef7a25716e78b4d894492e2d71e8459d960

SHA256
6d41af53bb1a5472a8c5d0f8b655226c017ce667e813e5764a4e3fa33f2302b6

SHA512
ad7f2c9a1d71d4374e64c2c215d6f7477293f35a3523057e5a9347278d31f42259bbc21d2193089e5854529bd6a87c86bab524935b9601232bf7cde89fbb6f88

Download Submit