576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
Size

38KB
MD5

8e09ff5618d042382ab1de8086ac2920
SHA1

5ea8c4bb01feca10b9e05bfed0ac4ede8a065b64
SHA256

576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadb
SHA512

999491a1f944a3bcbb488c95d77cfc680d1411e92c04ca40d4aa4fc7b6302549bbffa0f9776aa570e3f3ac943ee2325515925e8c68d423cd81e15b6729648d95
SSDEEP

768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5ltR:W7ZhA7pApM21LOA1LOl6AR

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe

C:\Users\Admin\AppData\Local\Temp\576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe
"C:\Users\Admin\AppData\Local\Temp\576666f7ab2fded38de176c519fcab7ad983b2fa797b9a46daa169b4df58dadbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
38KB

MD5
f4b79fa7d6f32682b61832cbbb8ea251

SHA1
cc17028fbe9cdf5f7704b0047c3e41a374248e44

SHA256
50bfd8c4cbed05378384575e9a4b25e2e7e1b494bc3712e0a7a4f841bb8dc88b

SHA512
54fb18279eb593563af61740ba0ebd427ca141e85b6a134f89585b13912bb32cfc80204b0c256403e6beab3d616afe6e7607e49d01349d8a6563bcacafe7f224

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
e03cfc00fa5bd8d5c5cdde5b403ae37d

SHA1
14097bf4ca22deff6faeb271f881fa56fbf3a10d

SHA256
dcee243b439f75a4d5a7cb7f6e99929f2c063f9a51deb7da5994113ad2d10ac3

SHA512
7b690b5f3e15d105ff81d3f3a22565d41f716c9abf299e67833ae4752c043ac0f109955ea6ab9e31507f7735fe544d9503d358e487582fa33ce3da0a49509f54

Download Submit