937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
Size

50KB
MD5

e0f0f7c903d12ffa939897831968c210
SHA1

685b75701c363f1f7d75cae99ac0c0dd1e3639b8
SHA256

937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750
SHA512

f57f46af4a19130fe5789b501ed2155161898f287ae37e61cef0f7660794dca438f466902931a1a09152294ad6004733a6882c6eaab0f878414852843019e834
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLkEbTa0TaK:W7ZppApBULcfpHLcfpyDeTXTb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe

C:\Users\Admin\AppData\Local\Temp\937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe
"C:\Users\Admin\AppData\Local\Temp\937af04a64bdbad22ef1a61bd932122ee59f3ff8b031618d1ab8dca66b6ce750N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
50KB

MD5
802350df5e66adcf3e9b109cd6f75620

SHA1
6a4accf06f2b21caadb06da37b12e98c7ff27a34

SHA256
33eb9169cca764d95c5bc45b45ea793e8ff6d2f23e6debca2ddd977b0c60926f

SHA512
551b8da95bf904614120a166aecc47989d3369ae3fd367a6cd3a6076df30a693df2eb0ab76d8faedaad232c72345549e9bf583828364aa658c7d050f3063f548

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
c094df5942a580a51f8e9d21eaca3fa2

SHA1
a39a576d67e7ab0673e568bebcb620428e2256dd

SHA256
152e1ad3df63a3087c46872ff4b28ab2295620d49130a5ba337fd9cd7b466245

SHA512
5a0d9d4f6301b9b92a2a0e697574571a3b2ec6932c6a575568bd9f907f7dd429af8be22bb5b9ef5899e7c46f096800c7c85da29a93ab1eb61105d1e22a6a3f7b

Download Submit