5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254e

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
Size

90KB
MD5

8b2169ab7c5095c9681de94defcf4d10
SHA1

0d5cb489f49b958469f3c40fcca748c1362db100
SHA256

5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254e
SHA512

819ceb5a497882931c97822e0d883b6ca3e484a4720be31b485e569967c323618ed0797a55f806476dd7375ec6b48abaee7d767019883ebbfde66596ac1b2b75
SSDEEP

768:/7BlpQpARFbhiWb8naOnaBGNS10w2Yw2l+Y:/7ZQpAp/Eaiax1n+Y

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4607) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe

C:\Users\Admin\AppData\Local\Temp\5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe
"C:\Users\Admin\AppData\Local\Temp\5b36c591ec79c0732e40c9a33960c34860245217f513c66afdc61868da65254eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
90KB

MD5
c3c79648a44a37ed7e3219295acaf3d7

SHA1
209883b8b12ae8167da4487298fcc560943b5a65

SHA256
ae7fb08ccbf696b947da8f0265f81c764063f68c84d15c478cb5b54b78d3fa1f

SHA512
b9f129b36dc78763bae531d9947d82aed980e4ca58da7409d04cda53bfe630bd886c362a87adfcf94a1815e3e63126da693fd7f8a66122f1bfe43475557b0d64

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
bc38c73dcb0ef3178adbc0863925bf97

SHA1
366ef72eabd564474e6b6bd1019de0e88062132e

SHA256
04d19217dd2e26e67b7a8522aec9e9be4857ccf6484f309466a3074e5559996e

SHA512
7787bdf5693536754d99c57f9a9165ccc12ad9756d9003fe511df58e0ad5eff66f7c14b7fd8c7311603cf3dac8324002372bd2f5bf4fa5dfc50b1c5cb94d1824

Download Submit
memory/544-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/544-866-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download