7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
Size

41KB
MD5

fc80bb637ee8f255d61650b898947a5b
SHA1

6e25278fa3ed0d2eb012efbccc04d6216c51c5cd
SHA256

7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef
SHA512

4545333fe7d24290f9668ca2c6751aa132f0fff43e6627aa2012cc4049d4306e9bc857c920ced0cd822aeba2a7d22937926d10e09b63cd7920069638a1d4ff72
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lt587edqdv87edqdl:W7ZhA7pApM21LOA1LOl6AC0l

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
File created	C:\Program Files\desktop.ini.tmp	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe

C:\Users\Admin\AppData\Local\Temp\7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe
"C:\Users\Admin\AppData\Local\Temp\7d2097a15707d20ae35dae576e8bf0e32f9670c34715a47b7bd58836cafb5eef.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
41KB

MD5
6744582d133c32a44322f6fc78b82c25

SHA1
6e04a9befed65c2df7e913260ba1aaa4abb943da

SHA256
29e03754d998a4a63c895cf99db07fc8e99b00a2914110513cfb50768d1ccbc4

SHA512
a74d0e32be60618dce0f4d9a022e34184ba3636c96f350d83dea29d8dbd304632108257c0079fde5d36c50d5445c3ce15285c138d35ea0c30651e5eb56958a29

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
ba5183e292744ee7f791701d6d18d9ec

SHA1
9854b880fa4f98ce4b83709242aeee26bd82b6ad

SHA256
0201946588e20a1a14ab6e85aa7ab61ebb54ab67a31015f86ec29b9ef0674574

SHA512
e49c94559a839c9cc5dfd95aef28a4f866d76d796e52e97f27e904bc34c12bc237d4daf9fb5516ceaf6e72f07995a9378cb1c013772b21610da034be995ceae4

Download Submit